DRAFT FOR APPROVAL. This is not an approved policy.
Who is responsible for the data
[Full legal name of the organisation], BIN [business identification number], address [registered address], website [final domain]. Contact for data-related enquiries: [verified email or postal address].
To be completed by the client: confirm the organisation, the person responsible and the scope of this document. The name DiaMed alone does not replace the organisation’s legal details.
Website visits and enquiries
In the reviewed local version, visitors can search for tests, choose a city and sample collection point, view programme conditions and follow links to contact information. The public forms on these pages do not require the patient’s full name.
The contents of hosting technical logs and records of enquiries by telephone and through external services have not yet been confirmed. [Specify the actual categories of data and their sources]. Data provided when contacting the laboratory must be described separately from simply browsing the website.
Purposes and grounds for processing
Confirmed website functions: displaying the catalogue and collection points for the selected city, searching for information, showing the map and restoring the position in the list.
For approval: [purpose → data → grounds → retention period] for each actual process, including enquiries and administrative access. [Specify where and how consent is requested, if required, and how it can be withdrawn]. These conditions are determined by the responsible specialist after reviewing the actual processes.
Cookies and browser storage
- Selected city. The
diamed_city cookie stores the city identifier; the current code sets its lifetime to up to one year.
- Language. An anonymous browsing check identified a
pll_language cookie associated with the language version.
- Returning to the catalogue. The browser’s session storage may contain the search phrase, category, page and list scroll position.
The catalogue search uses URL parameters: the query may remain in the browser history. Which queries are retained in server logs is [to be confirmed with the hosting provider].
Confirm before launch: the complete list of cookies and their lifetimes on the final website, including administrative functions and any additional services. Disabling browser storage may affect remembering a selection and returning to the list.
City detection and the map
Finding the nearest city is initiated by the visitor’s button and uses the browser’s geolocation permission. In the reviewed code, coordinates are compared in the browser, after which the selected city identifier is sent to the website.
The collection point map requests images from an external provider; during the local website check, requests were sent to OpenStreetMap. [Confirm the provider and its terms of use on the final website].
When following links to 2GIS, Instagram, a messenger or another external service, that service’s rules apply. [Describe the actual recipients and connections used; confirm whether analytics will be used].
Storage, access and transfer
[Specify the hosting provider, contractors, countries where databases and backups are located, data recipients and access conditions]. These details cannot be determined from the local mock-up.
[Specify retention and deletion periods for each category, how backups and logs are handled, and the procedure for responding to enquiries]. Do not replace these details with general promises such as “we do not transfer anything” or “we retain data indefinitely”.
The final section must be reviewed by the responsible specialist with regard to the actual infrastructure and applicable requirements.
User requests
For questions about data processing: [email or postal address of the responsible person]. [Describe the available requests, the information needed for identification, the review procedure and applicable time limits].
The test search is not intended for sending results, passwords or medical documents. For such enquiries, the client must establish a separate verified channel and describe it here.
Obtaining test results
In the current version of the website, the results service is not connected. The order number and password fields are disabled, and the form does not send these data.
Complete before connecting: [data involved], [laboratory system and recipients], [grounds and access method], [storage and protection], [user support]. This draft does not describe an integration that has not yet been implemented as an operational service.
Version and approval
[Approval date] · [Document version]. Add the date after actual approval.
Before publication, replace all square-bracketed placeholders and editorial instructions, check the Russian and Kazakh versions against each other, and review the functions of the final website again. Changes to services or the connection of results require the content to be revised.
