Version 2.1
Privacy and Personal Data Processing Policy

How MEDITEXT CONSULTING LLC processes and protects personal data.

PRIVACY AND PERSONAL DATA PROCESSING POLICY

MEDITEXT CONSULTING LLC

Revision of 29.09.2026. The current revision is published at https://www.meditext.com.ua.

1. GENERAL PROVISIONS

1.1. This Privacy and Personal Data Processing Policy (the "Policy") sets out how personal data of natural persons (the "Users", "Data Subjects") is processed and protected by MEDITEXT CONSULTING Limited Liability Company where those persons interact with it through the website https://www.meditext.com.ua, enquiry forms, email, telephone or any other channel.

1.2. Controller of personal data (the "Controller", the "Company", "we"):

  • Name: MEDITEXT CONSULTING Limited Liability Company (MEDITEXT CONSULTING LLC);
  • EDRPOU code: 45551955;
  • Registered office: 53A Peremohy Ave., office 3-4, Kharkiv, 61201, Ukraine;
  • Contact: +38 (067) 495-08-80, email: admin@meditext.com.ua.

1.3. This Policy is made under the Law of Ukraine "On Personal Data Protection" No. 2297-VI of 1 June 2010 (the "Law No. 2297-VI") and the Constitution of Ukraine. The Company is resident in Ukraine, has no branch or establishment in the European Union, its clients are healthcare facilities in Ukraine, and it neither offers services to persons in the EU nor monitors their behaviour. Renting server capacity in an EU member state does not of itself create an establishment within the meaning of Article 3 of Regulation (EU) 2016/679.

1.4. The requirements of Regulation (EU) 2016/679 (GDPR) are considered separately where the Company processes the data of persons located in the EU, in particular in connection with cooperation with international clinical trial sponsors and contract research organisations (CROs).

1.5. By using the website or providing personal data, the User confirms that they have read this Policy.

2. CATEGORIES OF PERSONAL DATA WE PROCESS

2.1. Whose data we process. The Company operates on a business-to-business basis, so the persons concerned are representatives of healthcare facilities: managers and officers, facility contact persons, principal investigators and members of investigator teams, and representatives of sponsors, contract research organisations and subcontractors.

2.2. Depending on the nature of the interaction, the Company may process:

  • identification and contact data: surname, first name, patronymic, organisation name and position, telephone number, email address;
  • data provided in enquiry forms and correspondence: the content of the request, information about the healthcare facility, consulting requirements;
  • technical data: IP address, browser and device type, data on interaction with the site (see the separate Cookie Policy);
  • contractual data: details required to conclude and perform contracts, and data of counterparties' representatives.

2.3. The Company does not collect data concerning the health of natural persons through the website, nor any other special category of data (Article 7 of Law No. 2297-VI). The forms on the website contain no fields for such data, and any information of that nature sent on a person's own initiative is deleted.

2.4. Within consulting projects the Company works with the documentation of healthcare facilities and with anonymised (aggregated) information.

3. PURPOSES AND LEGAL BASES OF PROCESSING

3.1. Purposes of processing (Article 6 of Law No. 2297-VI):

  • handling enquiries and requests, providing answers and consultations;
  • concluding and performing contracts for consulting services;
  • providing information about the Company's services (with consent, marketing communications);
  • operating, securing and improving the website;
  • complying with statutory requirements, including tax and accounting obligations.

3.2. Legal bases of processing (Article 11 of Law No. 2297-VI):

  • legitimate interest of the Controller (Article 11(1)(6)) — the basis for handling enquiries submitted through the form on the website. A person using the form approaches us as a representative of a healthcare facility, on that facility's business, providing business contact details in order to obtain a business reply. The Company's legitimate interest is to handle that enquiry and to communicate about it. The processing is limited to business contact details, does not extend to the person's private life and involves no profiling, and therefore does not override the rights of the data subject;
  • conclusion and performance of a transaction (contract) to which the data subject is a party — for data connected with the performance of the contract;
  • compliance with a legal obligation of the Controller — for tax and accounting purposes;
  • consent of the data subject — separately, and solely for marketing communications that are not a reply to an enquiry.

3.3. A person whose data is processed on the basis of legitimate interest has the right to object to that processing. Where an objection is made, processing ceases, except where the Company has other legal grounds that prevail.

4. DISCLOSURE TO THIRD PARTIES

4.1. The Company's role. In respect of data collected through the website and the Company's own channels of communication, the Company is the controller. Where, within a project, a healthcare facility instructs the Company to process data of which the facility itself is the controller, the Company acts as a processor, within the written instruction and solely on the facility's directions.

4.2. The Company does not sell personal data. Data may be disclosed to:

  • processors — the provider of the cloud infrastructure on which the website runs (DigitalOcean, LLC), and providers of accounting, email and other services. Processors act on the Controller's instructions, within a data processing agreement, and are bound to confidentiality;
  • project partners (sponsors, CROs) — solely where there are legal grounds and, where required, the consent of the data subject;
  • public authorities — in the cases and in the manner provided by law.

4.3. Where data is stored. Data collected through the website is stored on a server rented by the Company from the cloud infrastructure provider DigitalOcean, LLC. The server is physically located in Frankfurt am Main, Federal Republic of Germany. The infrastructure provider is a processor of personal data: it maintains the equipment, does not use the data for its own purposes, and acts under a data processing agreement.

4.4. Legal basis for the cross-border transfer. Storing data outside Ukraine constitutes a cross-border transfer within the meaning of Article 29 of Law No. 2297-VI. Germany is a member state of the European Economic Area and a party to Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and therefore belongs to the states which, under Article 29(2) of Law No. 2297-VI, are recognised as providing an adequate level of personal data protection. Transfers to such states are made on general grounds and require no separate authorisation.

4.5. Transfers to third parties abroad. Where the Company cooperates with foreign sponsors or contract research organisations, data may be transferred to recipients in other states, subject to Article 29 of Law No. 2297-VI and, where applicable, the corresponding GDPR safeguards (adequacy decisions, standard contractual clauses and the like).

5. RETENTION PERIODS

5.1. Personal data is retained no longer than is necessary to achieve the purpose of processing, and for the periods established by law, in particular for accounting and tax purposes.

5.2. Retention periods:

  • data from enquiries and requests that did not lead to a contract — 1 (one) year from the date of the last communication, after which it is deleted or anonymised;
  • data connected with the performance of a contract — for the term of the contract and 3 (three) years after its completion. This period corresponds to the general limitation period (Article 257 of the Civil Code of Ukraine) and to the minimum retention period for primary accounting records;
  • data for which the law establishes longer retention periods (tax and archival requirements) — for those periods.

5.3. A data subject may request the deletion of their data before the periods above expire, except where processing is necessary to comply with a legal obligation.

6. RIGHTS OF THE DATA SUBJECT

6.1. Under Article 8 of Law No. 2297-VI, the User has the right:

  • to know the sources, the location and the purpose of the processing of their data;
  • to obtain access to their personal data;
  • to require the correction (clarification), deletion or destruction of data where it is processed unlawfully or is inaccurate;
  • to withdraw consent to processing at any time and without giving reasons (from the moment of withdrawal the Controller ceases processing carried out on the basis of consent);
  • to raise a reasoned objection to processing;
  • to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with a court.

6.2. To exercise these rights, the User contacts the Controller using the details in sections 1 and 8. The Company considers requests within 30 calendar days of receipt.

6.3. No automated decision-making or profiling is carried out: decisions concerning Users are taken by people.

6.4. Data of minors. The website addresses a professional audience and is not intended for persons under 18. The Company does not knowingly collect their data; where such data reaches us in error, it is deleted.

7. SECURITY OF PERSONAL DATA

7.1. The Company applies organisational and technical measures to protect personal data against unlawful processing, loss, destruction and unauthorised access. In particular:

  • encryption in transit — the site is accessible over HTTPS only;
  • role-based access control: an employee has access only to the data required for their duties;
  • a limit on concurrent sessions — one account cannot be used from several devices at the same time;
  • rate limiting on public forms, to prevent automated data collection;
  • regular backups of the database;
  • confidentiality undertakings from employees with access to data.

7.2. Access to personal data is held only by employees of the Company for whom it is necessary in the performance of their duties. The cloud infrastructure provider and the other processors named in clause 4.2 have technical access solely to the extent required to provide their services and do not use the data for their own purposes.

7.3. The Company does not collect data concerning the health of natural persons through the website and does not request such data in its contact forms. The website collects no special categories of personal data within the meaning of Article 7 of Law No. 2297-VI.

8. CONTACT AND CHANGES TO THIS POLICY

8.1. For questions about the processing of personal data, the exercise of a data subject's rights or the withdrawal of consent, please contact: MEDITEXT CONSULTING LLC, email: admin@meditext.com.ua, tel.: +38 (067) 495-08-80, address: 53A Peremohy Ave., office 3-4, Kharkiv, 61201, Ukraine. The person responsible for personal data protection is S. O. Manzhos (email: admin@meditext.com.ua).

8.2. The Company may amend this Policy. The current revision, with its number and date, is always available at the address given at the beginning of this document. Users who have left their contact details are notified of material changes by email.