POLICY regarding the processing of personal data in Joint-Stock Company “Retinix”

1. General Provisions

1.1. This Policy regarding the processing of personal data (hereinafter referred to as the Policy) is approved by the General Director of Joint-Stock Company “Retinix” (hereinafter referred to as the Company) and determines the measures, procedures, and rules for protecting information in the Company’s information systems, in order to comply with the requirements of the Federal Law dated 27.06.2006 No. 152-FZ “On Personal Data”. The Policy defines the general procedure, principles, and conditions for processing personal data by the Company and ensures the protection of the rights of subjects of personal data when processing their personal data.

1.2. The basic concepts used in the Policy correspond to the definitions given in the Federal Law dated 27.07.2006 No. 152-FZ “On Personal Data”.

2. Basic Rights and Obligations of the Operator

2.1. The Company, acting as a Personal Data Operator, processes personal data on a legal and fair basis, observing the rights and freedoms of subjects of personal data.

2.2. The Company is obliged to provide the subject of personal data at their request with information regarding the processing of their personal data.

2.3. The Company is obliged to take the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions.

2.4. The Company is obliged to publish or otherwise provide unrestricted access to this Policy.

3. Basic Rights of the Subject of Personal Data

3.1. The subject of personal data has the right to:

• Require the Company to clarify their personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing.
• Withdraw their consent to the processing of personal data.
• Demand the elimination of unlawful actions by the Company in relation to their personal data.
• Appeal against the actions or inaction of the Company to the authorized body for the protection of the rights of subjects of personal data (Roskomnadzor) or in court.

4. Purposes of Processing Personal Data

The Company processes personal data for the following purposes:

• Conclusion, execution, and termination of civil law contracts with clients and counterparties.
• Providing services for the analysis of OCT scans using artificial intelligence technologies.
• Identification of patients (subjects of OCT studies), reflecting information in medical documentation, and providing the analysis results to the attending physician.
• Fulfillment of the requirements of the current legislation of the Russian Federation (including in the field of healthcare, accounting, and taxation).
• Implementation of labor relations with the Company’s employees.
• Consideration of appeals and requests from individuals.

5. Composition of Processed Personal Data

5.1. Depending on the purposes of processing, the Company may process the following categories of personal data:

• In relation to patients (subjects of OCT studies): anonymized data of OCT scans, study identification number, gender, age, anamnestic data related to ophthalmological status (diagnosis, stage of disease, AMD biomarkers). The processing of special categories of personal data (health data) is carried out with the written consent of the subject or in cases directly provided for by federal legislation.
• In relation to counterparties and representatives of clients (legal entities): surname, name, patronymic, position, contact details (phone, e-mail).
• In relation to the Company’s employees: data necessary for the implementation of labor relations in accordance with the Labor Code of the Russian Federation.

6. Procedure and Conditions for Processing Personal Data

6.1. The processing of personal data is carried out both with the use of automation tools and without their use.

6.2. When processing personal data, the Company takes all necessary measures to protect them, including assessing the harm that may be caused to subjects, determining actual threats, and applying appropriate organizational and technical protection measures in accordance with the requirements of the law.

6.3. The Company ensures the recording, systematization, accumulation, storage, clarification of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.

6.4. Access to personal data is granted only to authorized employees of the Company for whom work with such data is necessary to perform their job functions.

7. Terms of Processing Personal Data

The terms of processing personal data are determined in accordance with the purposes of their processing, the requirements of the legislation of the Russian Federation, and the terms of contracts with data subjects. The processing of personal data is terminated upon achievement of the processing goals, upon expiration of the subject’s consent or upon revocation of such consent, as well as in the event of detection of unlawful processing.

8. Cross-border Transfer of Personal Data

The cross-border transfer of personal data to the territory of foreign states is carried out by the Company only in the case of ensuring adequate protection of the rights of subjects of personal data and in accordance with the current legislation of the Russian Federation.

9. Final Provisions

9.1. This Policy is a public document and must be posted on the official website of the Company on the Internet.

9.2. The current legislation of the Russian Federation applies to this Policy and the relations associated with the processing of personal data.

9.3. Control over the fulfillment of the requirements of this Policy is carried out by the person responsible for organizing the processing of personal data in the Company.

Contact Information:

• Joint-Stock Company “Retinix”
• Address: 142600, Moscow region, Orekhovo-Zuyevo, Moskovskaya st., 2
• OGRN: 1255000060590
• INN: 5034071640
• KPP: 503401001
• Email for inquiries regarding personal data: Info@retinix.ru

Authorized Body for the Protection of the Rights of Subjects of Personal Data:

• Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor)
• Address: 109074, Moscow, Kitaygorodskiy proezd, 7, bldg. 2.
• Website: https://rkn.gov.ru
• Inquiry Service Phone: +7 (495) 987-68-00