Privacy Policy

Last updated: 12 April 2026

1. General Provisions

1.1. This Privacy Policy (hereinafter, the Policy) defines the procedure for processing the personal data of users of the website located on the Internet at: https://plastic-surgeon-grigoriak.ru (hereinafter, the Site), as well as the measures taken to ensure the security of such personal data.

1.2. The Personal Data Operator is Vivi Med Limited Liability Company
OGRN: 1257700578079
INN: 9729413563
Registered address: 119620, Moscow, intracity territory municipal district Solntsevo, Solntsevsky Prospekt, 12, premises 185
E-mail: ceo@vivimed.net
Phone: +7 936 222-22-71
(hereinafter, the Operator).

1.3. This Policy has been developed in accordance with the legislation of the Russian Federation on personal data, including Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data,” and other applicable regulatory legal acts of the Russian Federation.

1.4. This Policy applies to all personal data received by the Operator:

through the Site’s forms;
when contacted by telephone;
by e-mail;
in messengers;
when subscribing to updates;
when using the Site, including data collected through cookies, web analytics tools, and other technical means.

1.5. This Policy applies to the processing of personal data of Users, Patients, and other persons who independently submit their data to the Operator in connection with the use of the Site, booking a consultation, obtaining information, sending reviews, messages, photo, audio, and video materials, or otherwise interacting with the Site.

1.6. This Policy does not apply to third-party websites that may be linked on the Site. The Operator does not control and is not responsible for the processing of personal data on third-party resources.

1.7. The Operator proceeds from the principle that, when processing personal data, the rights and freedoms of individuals must be respected, including the right to privacy and personal and family confidentiality.

1.8. This Policy is a publicly available document. The current version of the Policy is posted on the Site in open access. The Operator ensures unrestricted access to this Policy.

1.9. The Operator may amend this Policy. A new version of the Policy becomes effective from the moment it is posted on the Site, unless a different effective date is provided in the new version. The User shall independently monitor the current version of the Policy and any amendments made thereto.

2. Terms and Definitions

2.1. Policy — this Privacy Policy.

2.2. Site — the website located at: https://plastic-surgeon-grigoriak.ru.

2.3. Operator — Vivi Med LLC, which independently organizes and carries out the processing of personal data and also determines the purposes of processing, the composition of the personal data, and the actions performed with such data.

2.4. User — any individual visiting the Site and using its functionality.

2.5. Patient — an individual who seeks a consultation, booking, discussion of a possible medical intervention, preparation for surgery, arrangement of a consultation or surgery, or receives relevant information in connection with the possible provision of medical services.

2.6. Personal Data — any information relating directly or indirectly to an identified or identifiable individual.

2.7. Processing of Personal Data — any action (operation) or set of actions (operations) performed with personal data, using automation tools or without such tools, including collection, recording, systematization, accumulation, storage, updating, extraction, use, transfer, anonymization, blocking, deletion, and destruction of personal data.

2.8. Automated Processing of Personal Data — processing of personal data using computer technology.

2.9. Provision of Personal Data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.10. Dissemination of Personal Data — actions aimed at disclosing personal data to an indefinite group of persons. Personal data permitted by the data subject for dissemination shall be processed on the basis of separate consent.

2.11. Anonymization of Personal Data — actions as a result of which it becomes impossible, without using additional information, to determine whether personal data belongs to a specific data subject.

2.12. Destruction of Personal Data — actions as a result of which personal data is irreversibly destroyed without the possibility of further recovery.

2.13. Cross-Border Transfer of Personal Data — transfer of personal data to the territory of a foreign state, to a foreign public authority, a foreign individual, or a foreign legal entity.

3. Composition and Categories of Personal Data Processed

3.1. The Operator may process the following personal data of Users and Patients:

last name, first name, patronymic;
telephone number;
e-mail address;
information provided by the User or Patient in an inquiry, application, correspondence, or telephone conversation;
information about the desired consultation, the proposed intervention, and the organizational conditions of booking;
information contained in messages, applications, reviews, and other materials voluntarily submitted to the Operator;
data automatically collected when using the Site, including cookies, information about the browser and its version, the operating system and its version, the type of device, screen resolution, the User’s actions on the Site, the source from which the User accessed the Site, geographic data, anonymized demographic and behavioral characteristics, information about ad blockers, and other technical and statistical data collected using web analytics tools and other technical means.

3.2. If a User or Patient independently sends the Operator photographs, video materials, medical documents, health information, or other sensitive data, the Operator may process such information only to the extent necessary for handling the inquiry, arranging the consultation, providing organizational support, and for other purposes предусмотренные by this Policy and the relevant consent of the personal data subject.

3.3. The Operator does not request through publicly accessible Site forms any excessive personal data that is not necessary to achieve the stated purposes of processing.

3.4. The Operator does not process biometric personal data for the purpose of identifying a personal data subject unless expressly required by law and based on separate consent of the personal data subject.

4. Purposes of Personal Data Processing

4.1. The Operator processes personal data for the following purposes:

processing applications and inquiries received through the Site, by telephone, by e-mail, and in messengers;
organizing feedback communication with the User or Patient;
booking a consultation;
organizational support for preparation for surgical intervention;
clarification of organizational conditions for the consultation, booking, and the proposed intervention;
sending notifications, instructions, responses to inquiries, and other messages related to booking and organizational support;
sending news, publications, updates, articles, and other informational messages where the User has given separate consent;
publishing reviews, photo, audio, video, and before-and-after materials where the relevant person has given separate consent;
analyzing Site traffic and improving its content, structure, functionality, and user experience;
ensuring the security of the Site and preventing spam, automated requests, and other abuses;
fulfilling obligations provided for by the legislation of the Russian Federation;
protecting the rights and legitimate interests of the Operator in the event of disputes, claims, and inquiries.

4.2. The Operator does not process personal data for purposes incompatible with those set out in this Policy. Personal data shall be destroyed or anonymized once the purposes of processing have been achieved or if the need to achieve such purposes ceases, unless otherwise provided by the legislation of the Russian Federation.

5. Legal Grounds for Processing Personal Data

5.1. The Operator processes personal data on the following legal grounds:

the consent of the personal data subject to the processing of their personal data;
the necessity of processing for the performance of agreements and arrangements to which the personal data subject is a party, or for taking steps at the request of the personal data subject prior to entering into such agreement;
the necessity of processing for the performance of obligations imposed on the Operator by the legislation of the Russian Federation;
other grounds provided for by the legislation of the Russian Federation on personal data.

5.2. In cases where the legislation requires the consent of the personal data subject, such consent shall be executed separately from other documents and other information confirmed or signed by the personal data subject.

5.3. Consent to the processing of personal data permitted by the personal data subject for dissemination shall be executed separately from other consents to the processing of personal data.

5.4. In cases where a User or Patient independently provides the Operator with personal data by telephone, e-mail, in messengers, through Site forms, or by any other means, the Operator proceeds on the assumption that such actions are performed voluntarily and consciously by the personal data subject within the purposes related to the relevant inquiry, booking, or organizational support.

6. Procedure and Conditions for Processing, Storage, and Transfer of Personal Data

6.1. Personal data shall be processed by the Operator in compliance with the principles of lawfulness, fairness, limitation of processing to specific, predetermined, and lawful purposes, and prevention of excessive processing of personal data.

6.2. The Operator processes personal data both using automation tools and without the use of such tools.

6.3. When collecting personal data of citizens of the Russian Federation, the Operator ensures the recording, systematization, accumulation, storage, updating, and extraction of such personal data using databases located within the territory of the Russian Federation.

6.4. The Operator takes the necessary legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions. Such measures include, in particular:

restricting access to personal data;
using information protection tools;
appointing responsible persons;
controlling access to information systems;
using organizational and technical measures aimed at ensuring the security of personal data.

6.5. The Operator may entrust the processing of personal data to third parties on the basis of a contract, provided that such persons comply with confidentiality and personal data security requirements. Such persons may include, in particular:

hosting providers;
technical contractors maintaining the Site;
communication and messaging services;
web analytics services;
form protection services against automated requests;
other contractors, where their involvement is necessary to achieve the purposes of personal data processing.

6.6. The Operator does not disseminate or provide personal data to third parties without a lawful basis, except in the following cases:

cases expressly provided for by the legislation of the Russian Federation;
cases where this is necessary to protect the rights and legitimate interests of the Operator;
cases where the personal data subject has given the relevant consent;
cases of entrusting the processing of personal data to persons engaged by the Operator to achieve the purposes of processing.

6.7. Personal data is stored no longer than required by the purposes of its processing, unless a different storage period is established by the legislation of the Russian Federation, a contract, the relevant consent of the personal data subject, or the nature of the dispute-related or organizational interaction.

6.8. The storage periods for certain categories of data are determined as follows:

data received when processing an inquiry or application — until the purpose of processing the inquiry is achieved and the relevant interaction is completed, unless longer storage is required to protect the rights and legitimate interests of the Operator;
data related to booking a consultation and organizational support — for the period necessary to perform the relevant organizational actions, settle possible disputes, and comply with legal requirements;
data used for mailings — until consent is withdrawn or the subscription is canceled;
data permitted for dissemination — until the relevant consent is withdrawn, the purpose of dissemination is terminated, or otherwise as provided by law.

6.9. Upon achievement of the purposes of processing, loss of necessity to achieve them, or upon a lawful request from the personal data subject, personal data shall be destroyed or anonymized, unless otherwise provided by the legislation of the Russian Federation.

6.10. The Operator may carry out cross-border transfer of personal data only where lawful grounds exist and subject to compliance with the legislation of the Russian Federation on personal data. Before such transfer begins, the Operator takes the necessary measures required by law.

7. Cookies, Yandex Metrica, and reCAPTCHA

7.1. The Site may use cookies and other technical means necessary for the proper functioning of the Site, improving user convenience, analyzing traffic, ensuring security, and protecting against automated requests.

7.2. Cookies are small data fragments that may be stored on the User’s device and used to recognize the browser, save user settings, ensure the operation of certain Site functions, and serve analytical and technical purposes.

7.3. When using the Site, web analytics services, including Yandex Metrica, may be used to analyze Site traffic, User behavior on the Site’s pages, improve the Site’s content, and enhance usability.

7.4. Yandex Metrica may use cookies and other technical means to collect anonymized information about visits to the Site, including information about the User’s actions on the Site’s pages, the device used, the browser, and other technical parameters.

7.5. To protect forms on the Site from spam, automated requests, and other abuse, technological solutions, including reCAPTCHA, may be used. If reCAPTCHA is used on the Site, it is applied in accordance with the terms of the relevant rights holder of that service.

7.6. The User may independently change browser settings regarding the use of cookies and may restrict or disable them. In doing so, the User understands that disabling cookies or other technical means may affect the proper functioning of certain Site features.

8. Rights of the Personal Data Subject

8.1. The personal data subject has the right to:

receive information concerning the processing of their personal data to the extent provided by the legislation of the Russian Federation;
require clarification, blocking, or destruction of their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing;
withdraw previously given consent to the processing of personal data;
withdraw consent to the processing of personal data permitted for dissemination;
opt out of receiving informational and advertising messages;
appeal actions or omissions of the Operator to the authorized personal data protection authority or in court.

8.2. Withdrawal of consent to the processing of personal data does not affect the lawfulness of the processing carried out before the Operator received such withdrawal.

8.3. In the event of withdrawal of consent, a request for destruction of personal data, or another request from the personal data subject, the Operator shall consider the relevant request and act in accordance with the procedure and time limits provided by the legislation of the Russian Federation.

9. Procedure for Inquiries Regarding Personal Data

9.1. On issues related to the processing of personal data, provision of consent, withdrawal of consent, clarification, blocking, deletion, destruction of personal data, as well as the exercise of other rights of the personal data subject, the User or Patient may contact the Operator at: ceo@vivimed.net.

9.2. It is recommended that the inquiry include:

the applicant’s full name;
contact details for communication;
the substance of the inquiry;
a description of the personal data in respect of which the inquiry is submitted;
where necessary, documents and other materials confirming the grounds of the inquiry.

9.3. The Operator may request additional information from the applicant necessary to identify the personal data subject and consider the inquiry on its merits.

9.4. If the inquiry is submitted by a representative of the personal data subject, the Operator may request documents confirming the authority of such representative.

9.5. Inquiries shall be considered within the time limits provided by the legislation of the Russian Federation.

10. Final Provisions

10.1. This Policy shall remain in effect indefinitely until replaced by a new version.

10.2. If any provision of this Policy is found to be invalid, unlawful, or unenforceable, this shall not affect the validity of the remaining provisions of the Policy.

10.3. This Policy applies only to the Site https://plastic-surgeon-grigoriak.ru and does not apply to other third-party websites or services, even if access to them is provided through links posted on the Site.

10.4. Users and Patients must independently review the current version of this Policy.