HayotLab App Privacy Policy

Information — details (messages, data) regardless of the form in which they are presented.

Personal data information system (PDIS) — the personal data contained in databases together with the information technologies and technical means used to process it.

Personal data processing — any action (operation) or set of actions (operations) performed on personal data with or without automation, including collection, systematisation, storage, modification, supplementing, use, provision, dissemination, transfer (including cross-border transfer), depersonalisation, blocking, deletion and destruction of personal data in accordance with the legislation of the Republic of Uzbekistan.

Personal data operator — a state body, an individual and/or a legal entity that, alone or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the scope of personal data to be processed and the actions (operations) performed on it.

Personal data (PD) — information recorded on an electronic, paper and/or other tangible medium relating to a directly or indirectly identified or identifiable individual (the personal data subject).

Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

Dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons.

Ensuring a necessary and sufficient level of personal data (PD) security is an essential condition for achieving the goals of OPTIMA LAB SERVICES LLC.

Ensuring the security of PD is one of our priorities.

OPTIMA LAB SERVICES LLC has put into effect a set of documents on PD security that is mandatory for compliance.

Information classified as PD is processed and protected at OPTIMA LAB SERVICES LLC in accordance with this set of documents. This ensures the protection of PD processed both in personal data information systems (PDIS) — systems created to process PD, to whose protection requirements and recommendations are set by the State Inspectorate for Control in the Field of Informatisation and Telecommunications of the Republic of Uzbekistan (Uzkomnazorat) and the State Security Service of the Republic of Uzbekistan — and in other information systems where PD is processed together with information protected under its own requirements (such as trade secrets).

This Personal Data Processing Policy of OPTIMA LAB SERVICES LLC (the Policy) sets out the principles, procedure and conditions for processing the PD of employees of OPTIMA LAB SERVICES LLC and of other persons whose personal data OPTIMA LAB SERVICES LLC processes, in order to protect human and civil rights and freedoms in the processing of PD, including the rights to privacy and to personal and family confidentiality. It also establishes the responsibility of OPTIMA LAB SERVICES LLC officials with access to personal data for failing to comply with the rules governing the processing and protection of PD.

This section describes the concept and composition of the personal data processed in the PDIS of OPTIMA LAB SERVICES LLC:

• a) The list of PD protected at OPTIMA LAB SERVICES LLC is formed in accordance with Law of the Republic of Uzbekistan No. ZRU-547 "On Personal Data" of 2 July 2019 and the Charter of OPTIMA LAB SERVICES LLC.
• b) PD at OPTIMA LAB SERVICES LLC means any information relating to a directly or indirectly identified or identifiable individual (the personal data subject).
• c) Depending on the data subject, OPTIMA LAB SERVICES LLC processes the PD of the following categories of subjects:
  • 1) PD of an employee of OPTIMA LAB SERVICES LLC — information that OPTIMA LAB SERVICES LLC needs in connection with the employment relationship and that concerns a specific employee;
  • 2) PD of a partner or counterparty, and PD of a manager or employee of a legal entity — information that OPTIMA LAB SERVICES LLC needs to fulfil its obligations under contractual relations with the Client and to comply with the legislation of the Republic of Uzbekistan.

OPTIMA LAB SERVICES LLC processes PD for the following purposes:

• a) Carrying out the activities provided for by the Charter and licences of OPTIMA LAB SERVICES LLC.
• b) Concluding and performing civil-law contracts with individuals and legal entities in the cases provided for by applicable law and the Charter of OPTIMA LAB SERVICES LLC.
• c) Personnel administration at OPTIMA LAB SERVICES LLC; ensuring compliance with laws and other regulations; concluding and performing obligations under employment and civil-law contracts; keeping personnel records; helping employees with employment, training, promotion and the use of benefits; meeting the requirements of tax legislation on the calculation and payment of personal income tax and social tax, and of pension legislation on the reporting of personalised data about each recipient of income taken into account for insurance contributions and mandatory contributions to individual accumulative pension accounts; and completing primary statistical documentation — in accordance with the Labour Code and the Tax Code of the Republic of Uzbekistan, the laws of the Republic of Uzbekistan including "On Accumulative Pension Provision for Citizens" and "On Personal Data", and the Charter of OPTIMA LAB SERVICES LLC.

This section describes the periods for processing PD in the PDIS of OPTIMA LAB SERVICES LLC:

• a) PD processing periods are determined by the term of the contract with the personal data subject, the Law of the Republic of Uzbekistan "On Archiving", the Regulation on the procedure for setting retention periods for archival documents and the lists of standard management archival documents created by organisations of the Republic of Uzbekistan, the limitation period, and other requirements of the legislation and regulations of the Republic of Uzbekistan.
• b) OPTIMA LAB SERVICES LLC creates and stores documents containing information about PD subjects. The requirements for using standard document forms are set by Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 71 of 8 February 2020 "On measures to improve the procedure for processing personal data" and by other regulations of the Republic of Uzbekistan governing the processing of personal data without automation.

Rights and obligations of OPTIMA LAB SERVICES LLC.

• a) OPTIMA LAB SERVICES LLC, as a PD operator, has the right to:
  • 1) defend its interests in court;
  • 2) provide the PD of subjects to third parties where required by applicable law (tax authorities, law enforcement, etc.);
  • 3) refuse to provide PD in the cases provided for by law;
  • 4) use the PD of a subject without their consent in the cases provided for by the legislation of the Republic of Uzbekistan.

Rights and obligations of the PD subject.

• b) The PD subject has the right to:
  • 1) demand that their PD be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and take the measures provided for by law to protect their rights;
  • 2) request the list of their PD processed by OPTIMA LAB SERVICES LLC and the source from which it was obtained;
  • 3) receive information about the periods for which their PD is processed, including retention periods;
  • 4) demand that everyone who previously received incorrect or incomplete PD about them be notified of all exclusions, corrections or additions made to it;
  • 5) appeal against unlawful actions or omissions in the processing of their personal data to the authorised state body for the protection of PD subjects' rights (Uzkomnazorat) or in court;
  • 6) protect their rights and legitimate interests, including claiming damages and/or compensation for moral harm in court.

This section describes the principles and conditions for processing PD in the PDIS of OPTIMA LAB SERVICES LLC:

• a) OPTIMA LAB SERVICES LLC processes PD on the basis of the following principles:
  • 1) lawfulness and fairness of the purposes and methods of PD processing;
  • 2) consistency of the purposes of PD processing with the purposes defined and stated in advance when the PD was collected, and with the powers of OPTIMA LAB SERVICES LLC;
  • 3) consistency of the volume and nature of the PD processed, and of the processing methods, with the purposes of processing;
  • 4) accuracy and sufficiency of personal data for the purposes of processing, and no processing of PD that is excessive in relation to the purposes stated when it was collected;
  • 5) no merging of databases containing PD that were created for mutually incompatible purposes;
  • 6) storing PD in a form that allows the subject to be identified no longer than the purposes of processing require;
  • 7) destruction of PD once the purposes of processing have been achieved or are no longer needed.
• b) PD is processed under the conditions set by the legislation of the Republic of Uzbekistan.

This section describes how PD security is ensured in the PDIS of OPTIMA LAB SERVICES LLC:

• a) OPTIMA LAB SERVICES LLC takes the necessary organisational and technical measures to protect PD against accidental or unauthorised access, destruction, modification, blocking and other unauthorised actions.
• b) OPTIMA LAB SERVICES LLC has appointed a person responsible for PD security to coordinate PD protection.

This Policy is a public document of OPTIMA LAB SERVICES LLC and is published on hayotlab.uz.

This Policy is amended and supplemented when new laws and special regulations on the processing and protection of PD are adopted, and at least once every three years.

Compliance with this Policy is monitored by the person responsible for PD security at OPTIMA LAB SERVICES LLC.

The responsibility of OPTIMA LAB SERVICES LLC officials with access to PD for failing to comply with the rules governing the processing and protection of PD is determined by the legislation of the Republic of Uzbekistan and the internal documents of OPTIMA LAB SERVICES LLC.

9.1. General. This section describes what data the HayotLab mobile app for iOS and Android (the App) collects and how it is used. The operator is OPTIMA LAB SERVICES LLC. This section applies to users of the App — patients of the laboratory.

9.2. Data we collect

• Account data: first name, last name, phone number, email address, date of birth, sex.
• Addresses for nurse home visits and details of family members that the user adds themselves (name, date of birth, sex).
• Medical data: test orders, laboratory test results, sampling conditions (height, weight, week of pregnancy, day of the cycle — if the user provided them).
• Health and fitness data — only with the user's explicit permission in the Apple Health (iOS) or Health Connect (Android) system dialog: steps, heart rate, heart rate variability, sleep and sleep stages, weight, height, blood pressure, blood glucose, body and skin temperature, blood oxygen saturation (SpO₂).
• Heart rate from Bluetooth heart rate monitors (standard Bluetooth Heart Rate Service) — if the user has connected the device themselves.
• Manually entered data: food diary, measurements (blood pressure, glucose, weight, temperature), cycle and pregnancy tracker, health questionnaire.
• Location — only while the App is in use and with the user's permission, to show the nearest collection points. It is not stored on the server.
• Order payment details: amount, payment method and status. Bank card data is processed by payment providers; the App does not store it.
• Technical data: device identifier for push notifications, crash reports.

9.3. How we use health data. Data from Apple Health, Health Connect and Bluetooth devices is used only to:

• show the user their metrics and their trends in the "Health" section;
• calculate the health score;
• suggest laboratory tests and check-ups suited to the user.

Health data is not used for advertising, is not sold, is not shared with third parties and is not used for decisions about insurance, credit or employment. Data from Health Connect is used in accordance with the Health Connect policies, including the Limited Use requirements. Wearable device data is not exchanged for discounts, points or any other material benefit.

The user can withdraw access at any time: in the Apple Health or Health Connect settings on the device, or in the App under Profile → Consents and data.

9.4. Sharing data with third parties. The App uses the following services:

• Firebase Cloud Messaging (Google) — delivery of push notifications; receives only the device identifier.
• Sentry — App crash reports; no health data is sent.
• Payme and Click payment systems and Hayot Bank card acquiring — payment for orders.
• Anthropic (Claude) — the AI assistant, only when the "AI assistant" consent is enabled. Only the text of the user's question or a list of test results (code, name, value, units) is sent, without the name, phone number, date of birth or any other identifiers.

Data is also provided to state authorities in the cases provided for by the legislation of the Republic of Uzbekistan.

9.5. Storage and protection. Data is stored on servers in the Republic of Uzbekistan and transmitted over a secure connection (HTTPS). Medical data can be accessed only by the user, the laboratory's doctors and people the user has granted access to in the App.

9.6. Account deletion. The user can delete their account in the App under Profile → Consents and data → "Close account", or by request to inbox@hayotlab.uz or by phone at +998 55 777 55 55. When the account is deleted, personal data, health data, the food diary and conversations with the AI assistant are deleted or depersonalised. Laboratory test results and payment records are kept in depersonalised form for 2 (two) years, as required by the legislation of the Republic of Uzbekistan.

9.7. Children. The App may be used independently from the age of 14; between 14 and 18 — with a parent's consent. The profile of a child under 14 is managed by a parent or legal guardian.

9.8. Contacts. For questions about the processing of personal data: inbox@hayotlab.uz, +998 55 777 55 55.