Legal information

Privacy policy

Who processes the data

Personal data operator:

AQUATIC — Children's Medical and Rehabilitation Center

Legal entity: Товарищество с ограниченной ответственностью "Aqua Health Center"

BIN 220240018576

Registered address: Казахстан, город Нур-Султан, район Есиль, улица Алматы, дом 11, кв. 91, почтовый индекс 010000

Clinic address: 7 Abiken Bekturov St, Astana

Phone: +7 778 099 57 58

Requests about personal data — access, correction, withdrawal of consent, deletion — should be sent to aquaticastana@gmail.com or made by phone. We reply within the period set by the Law of the Republic of Kazakhstan «On Personal Data and Its Protection».

1. What data we collect

An honest breakdown, channel by channel.

On this website — only what you enter in the booking form

The site sets no advertising pixels and sends no information about your visits to third-party analytics. Anonymous counts — how many times a page was opened and a button clicked — are kept by the clinic itself, without IP addresses and without cookies. A 2GIS map is embedded at the bottom of every page and on the contacts page: it is a third-party service, it loads together with the page and may set its own cookies, which the clinic does not control. Fonts are served from the site own server; no third-party font services are used. The hosting provider keeps technical access logs — a standard server record needed to run and secure the site.

If you fill in the booking form, we receive your first name, last name and phone number. Together with the request we store the language you sent it in, the section of the site you opened the form from, and the name of the promotion if the request was sent through one. The form asks nothing about the child's health or the reason for the visit: the administrator will ask about that on the phone, and it will be recorded in the medical documentation.

The request is stored in the site's database and arrives as a notification in the clinic's work chat, which the administrators and the head of the clinic belong to. The notification contains the same details: first name, last name and phone number, and also the language, the section of the site and the name of the promotion if there was one. The chat is hosted in Telegram, which means the message passes through the servers of Telegram Messenger LLP.

In WhatsApp conversations

Your phone number, the name you introduced yourself with, and the content of your message — whatever you write yourself. Voice messages and photos are kept in the conversation.

Some messages are answered by the clinic's automated assistant, which helps you book an appointment. The assistant does not diagnose, does not give medical advice and does not assess the child's condition: it passes such questions to an administrator. You can ask to be connected to a person at any time.

When booking an appointment

The child's first and last name, date of birth, the name and phone number of the parent or legal guardian, the chosen service, the specialist, and the date and time of the visit. Information about the child's health is entered by the doctor into the medical documentation — it is restricted-access data and is protected separately.

Children's data

A child does not contact us on their own. The data of a minor is provided by a parent or legal guardian, who also gives consent to processing and may withdraw it.

2. Why we need this data

• To book the child for an appointment and find a convenient time.
• To remind you of the visit in advance and confirm that you are coming.
• To let you know if the appointment is rescheduled or cancelled.
• To process payment for the service.
• To ask after the visit whether everything was fine.
• To keep medical documentation as required by law.

The data is not used for other purposes — advertising mailings, for example — without your separate consent.

3. On what grounds we do this

The grounds are your consent and the contract for medical services; for keeping medical documentation, it is a direct requirement of the legislation of the Republic of Kazakhstan.

• The booking form. There is a consent checkbox under the form, and a request cannot be sent without it: the clinic receives your first name, last name and phone number only after you have ticked it. The full text of the consent opens from the link next to the checkbox. If you do not agree with it, you can book by phone or on WhatsApp.
• Service messages. When you write to us on WhatsApp, you agree to receive replies about your request: booking confirmation, a reminder of the visit, a payment link, a notice of rescheduling.
• Advertising and informational mailings. These require separate consent. Silence does not count as consent. You may opt out at any time, and this does not affect your ability to book an appointment.

4. Who the data is shared with

We do not sell data and do not pass it to third parties for their own purposes. For the clinic to operate, part of the data is processed by our service providers:

• Meta Platforms (WhatsApp Business). The conversation itself goes through the WhatsApp service: without it your message would not reach us.
• Altegio. The clinic's CRM system: schedule, client record, appointments.
• Telegram Messenger LLP. Notifications about requests from the booking form arrive in the clinic's work chat through Telegram. The first name, last name and phone number from the request go there — nothing beyond that.
• Google Cloud (Gemini API). The language model behind the automated assistant. Requests are processed in the European region, and the model is not trained on conversation data. Only the substance of the request and service identifiers are sent to the model — names, phone numbers and medical information are not.
• Payment provider. Processes the payment. Bank card details are entered on their side and never reach the clinic.
• Hosting provider. The server that runs the site and the clinic's systems.

Data is disclosed to state authorities only in the cases directly provided for by law and only to the extent the law requires.

5. How long data is kept

• WhatsApp conversations — for the period set by the clinic.
• Requests from the booking form — six months after the administrator has handled them: called back and arranged the appointment. An unhandled request is kept — the clinic does not delete a request it has not answered yet.
• Appointment data in the CRM — for the period set by the clinic.
• Medical documentation — for the period set by the healthcare legislation of the Republic of Kazakhstan.
• Payment documents — for the period set by tax legislation.

When the period expires or you withdraw your consent, the data is deleted or anonymised, except for what we are required by law to keep.

6. Your rights

You can:

• find out what data about you and your child we hold;
• request correction of inaccurate data;
• withdraw your consent to processing;
• request deletion of your data, except what the clinic is required by law to keep;
• opt out of advertising messages while keeping the ability to book appointments;
• complain to the authorised body for personal data protection.

So that we do not release a child's data to an outsider, you will need to confirm that you are the parent or legal guardian when you contact us.

7. How we protect data

The site and the clinic's systems run over HTTPS. Access to the CRM and to conversations is limited to the staff who need it for their work. Keys and passwords for external services are stored separately from the code. Requests to the systems are written to a log so that a disputed situation can be investigated.

8. Changes to this policy

The policy may change — for example, if a new way to book appears or a service provider changes. The current version is always available at this address, and the date of the version is shown at the top of the page. If the changes affect your rights, we will tell you in the same channel we use to communicate with you.

← Back to the home page