Personal data processing policy

OOO NPO “Tsifrovoy kontur”, 8 October 2026

English translation. Russian version.

General provisions

This Policy of the Limited Liability Company Research and Production Association “Tsifrovoy kontur” (hereinafter the Operator or the Company) on the processing of personal data (hereinafter the Policy) has been developed pursuant to Article 18.1(1)(2) of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter the Personal Data Law) in order to protect the rights and freedoms of individuals and citizens when their personal data is processed, including the rights to privacy and to personal and family confidentiality. The Operator provides users with the Oreol mobile app, an informational reference service for keeping personal health records (hereinafter the Service). The Service includes Lum, a virtual assistant that runs on artificial intelligence technologies (hereinafter the Assistant).
The Policy applies to all personal data processed by the Company, including the personal data of users of the Service.
The Policy applies to personal data processing relations that arose for the Operator both before and after this Policy was approved.
Pursuant to Article 18.1(2) of the Personal Data Law, this Policy is published in open access on the Internet on the Operator's website https://oreol.ai and is available in the Service.
Key terms used in the Policy:
- personal data means any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
- personal data operator (operator) means ООО НПО «Цифровой контур» (OOO NPO “Tsifrovoy kontur”), which, alone or jointly with others, organizes and/or carries out the processing of personal data and determines the purposes of processing, the personal data to be processed and the actions (operations) performed on personal data;
- personal data subject means an individual;
- user means an individual who uses the Service;
- processing of personal data means any action (operation) or set of actions (operations) performed on personal data, with or without automated tools. Processing of personal data includes, among other things:
  - collection;
  - recording;
  - organization;
  - accumulation;
  - storage;
  - updating (refreshing, modification);
  - retrieval;
  - use;
  - transfer (dissemination, provision, access);
  - depersonalization;
  - blocking;
  - deletion;
  - destruction;
- automated processing of personal data means processing personal data using computing equipment;
- dissemination of personal data means actions aimed at disclosing personal data to an indefinite range of persons;
- provision of personal data means actions aimed at disclosing personal data to a specific person or a specific range of persons;
- blocking of personal data means the temporary suspension of personal data processing (except where processing is necessary to correct the personal data);
- destruction of personal data means actions that make it impossible to restore the content of personal data in a personal data information system and/or that destroy the physical media containing personal data;
- depersonalization of personal data means actions that make it impossible, without additional information, to determine to which personal data subject the personal data belongs;
- personal data information system means the personal data contained in databases together with the information technologies and technical means that process it.
Key rights and obligations of the Operator.
1. The Operator has the right to:
  - determine independently the composition and list of measures necessary and sufficient to fulfil the obligations set out in the Personal Data Law and the regulations adopted under it, unless otherwise provided by the Personal Data Law or other federal laws;
  - entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person. A person processing personal data on behalf of the Operator must comply with the principles and rules of personal data processing set out in the Personal Data Law, keep personal data confidential, and take the measures necessary to fulfil the obligations set out in the Personal Data Law;
  - if the personal data subject withdraws consent to the processing of personal data, continue processing the personal data without the subject's consent where there are grounds set out in the Personal Data Law.
2. The Operator must:
  - organize the processing of personal data in accordance with the Personal Data Law;
  - respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the Personal Data Law;
  - at the request of the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media, Roskomnadzor), provide it with the necessary information within 10 working days of receiving the request. This period may be extended by no more than five working days. To do so, the Operator must send Roskomnadzor a reasoned notice stating the reasons for extending the deadline for providing the requested information;
  - in the manner determined by the federal executive authority responsible for security, interact with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it of computer incidents that resulted in the unlawful transfer (provision, dissemination, access) of personal data.
Key rights of the personal data subject. The personal data subject has the right to:
- receive information concerning the processing of their personal data, except in cases provided for by federal laws. The Operator provides this information to the personal data subject in an accessible form, and it must not contain personal data relating to other personal data subjects, unless there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are set out in the Personal Data Law;
- require the operator to correct, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and take the measures provided for by law to protect their rights;
- give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
- appeal against unlawful actions or omissions of the Operator in processing their personal data to Roskomnadzor or in court.
Compliance with this Policy is monitored by the authorized person responsible for organizing personal data processing at the Operator.
Liability for violating the legislation of the Russian Federation and the Company's internal regulations on the processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

Purposes of collecting personal data

The processing of personal data is limited to achieving specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes for which it was collected is not permitted.
Only personal data that meets the purposes of its processing is processed.
The Operator processes personal data for the following purposes:
- providing users with the Service for keeping personal health records: storing and organizing laboratory test results and medical documents uploaded by the user, displaying measurements and their trends for reference, reminding about due dates, and providing reference answers from the Assistant;
- concluding and performing civil law contracts with counterparties;
- keeping HR and accounting records.
Employees' personal data may be processed solely to ensure compliance with laws and other regulations.
The Service is not a medical device and is not intended for diagnosis or treatment. The information shown by the Service and the Assistant's answers are for reference only and do not replace a consultation with a doctor.

Legal grounds for processing personal data

The legal ground for processing personal data is the set of regulations pursuant to and in accordance with which the Operator processes personal data, including:
- the Constitution of the Russian Federation;
- the Civil Code of the Russian Federation;
- the Labor Code of the Russian Federation;
- the Tax Code of the Russian Federation;
- Federal Law No. 402-FZ of 6 December 2011 “On Accounting”;
- Federal Law No. 167-FZ of 15 December 2001 “On Mandatory Pension Insurance in the Russian Federation”;
- other regulations governing relations connected with the Operator's activities.
The legal grounds for processing personal data also include:
- the Company's charter;
- contracts concluded between the Operator and personal data subjects, including the Service's user agreement and employment contracts;
- the consent of personal data subjects to the processing of their personal data.
The personal data of users of the Service, except health information, is processed on the basis of the user's consent (Article 6(1)(1) of the Personal Data Law) and to perform the user agreement to which the user is a party (Article 6(1)(5) of the Personal Data Law).
Health information of users of the Service is processed only with the user's written consent (Article 10(2)(1) of the Personal Data Law). This consent is given separately from the user agreement and other documents (Article 9(1) of the Personal Data Law) and is signed in the Service with an electronic signature (Article 9(4) of the Personal Data Law). The user agreement is not a ground for processing health information.
The personal data of representatives and employees of counterparties is processed to perform a contract (Article 6(1)(5) of the Personal Data Law) in accordance with Articles 49, 53 and 185 of the Civil Code of the Russian Federation.
The personal data of employees, former employees and job candidates is processed on the basis of the Labor Code of the Russian Federation, the Tax Code of the Russian Federation, Federal Law No. 402-FZ of 6 December 2011 “On Accounting”, employment contracts, and Article 6(1)(2) and (5) of the Personal Data Law.

Scope and categories of personal data processed, categories of personal data subjects

The content and scope of the personal data processed must correspond to the stated purposes of processing set out in section 2 of this Policy. The personal data processed must not be excessive in relation to the stated purposes of its processing.
The Operator may process the personal data of the following categories of personal data subjects:
1. Users of the Service, for the purpose of providing the Service:
  - surname, first name, patronymic;
  - email address;
  - phone number;
  - sex;
  - date of birth (age);
  - account identifier;
  - anthropometric data (height, body weight);
  - information given in the user questionnaire: how regularly the user exercises, and bad habits.
  Special categories of personal data (health information):
  - information about chronic and genetic diseases given in the user questionnaire;
  - laboratory test results;
  - medical documents and information extracted from them: doctors' reports, visit records, discharge summaries, referrals, prescriptions;
  - diagnoses;
  - prescribed treatment and medications taken;
  - allergies;
  - information the user shares with the Assistant.
2. Employees, former employees and candidates for employment with the Operator, for the purpose of keeping HR and accounting records:
  - surname, first name, patronymic;
  - date and place of birth;
  - passport details;
  - registered address and actual residential address;
  - individual insurance account number (SNILS);
  - taxpayer identification number (INN);
  - education;
  - employment history;
  - marital status;
  - military registration;
  - bank details;
  - salary.
3. Representatives and employees of the Operator's counterparties, for the purpose of concluding and performing civil law contracts:
  - surname, first name, patronymic;
  - position;
  - contact phone number;
  - email address;
  - details of the document confirming their authority.
The Operator does not process biometric personal data.
Of the special categories of personal data, the Operator processes only health information of users of the Service, to the extent specified in clause 4.2.1, and only with their written consent (clause 3.4 of the Policy). The Operator does not process personal data concerning race, ethnicity, political views, religious or philosophical beliefs, or intimate life.

Procedure and conditions for processing personal data

The Operator processes personal data in accordance with the legislation of the Russian Federation.
Personal data is processed with the consent of personal data subjects to the processing of their personal data, and without such consent in cases provided for by the legislation of the Russian Federation.
For each purpose of processing, the Operator processes personal data in the following ways:
- non-automated processing of personal data;
- automated processing of personal data, with or without transmitting the information obtained over information and telecommunication networks;
- mixed processing of personal data.
Personal data may be processed only by employees of the Operator whose job duties include processing personal data.
For each purpose of processing specified in clause 2.3 of the Policy, personal data is processed by:
- obtaining personal data orally and in writing directly from personal data subjects, including through the Service;
- entering personal data into the Operator's logs, registers and information systems;
- other methods of processing personal data.
Personal data must not be disclosed to third parties or disseminated without the consent of the personal data subject, unless otherwise provided by federal law. Consent to the processing of personal data that the personal data subject has permitted for dissemination is given separately from the subject's other consents to the processing of their personal data.

The requirements for the content of consent to the processing of personal data permitted by the personal data subject for dissemination are approved by Roskomnadzor Order No. 18 of 24 February 2021.
Personal data is transferred to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia and other authorized executive bodies and organizations in accordance with the legislation of the Russian Federation.
The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, dissemination and other unauthorized actions, including the following:
- appoints a person responsible for organizing personal data processing;
- assesses the harm that may be caused to personal data subjects;
- identifies threats to the security of personal data during processing;
- adopts internal regulations and other documents governing the processing and protection of personal data;
- appoints persons responsible for the security of personal data in the Operator's departments and information systems;
- creates the necessary conditions for working with personal data;
- keeps records of documents and machine media containing personal data;
- organizes work with the information systems in which personal data is processed;
- restricts access rights to personal data and identifies users of information systems;
- uses firewalls and antivirus protection;
- encrypts communication channels when transmitting data over the Internet;
- backs up and restores personal data;
- keeps a security event log, detects unauthorized access to personal data and responds to it;
- stores personal data under conditions that keep it safe and prevent unlawful access to it;
- monitors the measures taken and the security level of personal data information systems;
- familiarizes the Operator's employees who process personal data with the requirements of the law and internal regulations, and organizes their training.
The Operator stores personal data in a form that allows the personal data subject to be identified for no longer than each purpose of processing requires, unless the storage period is established by federal law or contract.
1. Personal data on paper is stored by the Company for the retention periods established for the corresponding documents by the archival legislation of the Russian Federation (Federal Law No. 125-FZ of 22 October 2004 “On Archival Affairs in the Russian Federation”; the List of Standard Administrative Archival Documents Generated in the Course of the Activities of State Bodies, Local Self-Government Bodies and Organizations, with Their Retention Periods, approved by Rosarkhiv Order No. 236 of 20 December 2019).
2. Personal data processed in personal data information systems is stored for the same period as personal data on paper.
The Operator stops processing personal data in the following cases:
- unlawful processing has been identified. Deadline: within three working days of identification;
- the purpose of processing has been achieved;
- the personal data subject's consent to processing has expired or been withdrawn, where under the Personal Data Law such data may be processed only with consent;
- the user has deleted their account in the Service;
- the Operator has been liquidated.
When the purposes of processing personal data have been achieved, or when the personal data subject withdraws consent to its processing, the Operator stops processing that data, unless:
- otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor;
- the Operator is entitled to process the data without the personal data subject's consent on grounds provided for by the Personal Data Law or other federal laws;
- otherwise provided by another agreement between the Operator and the personal data subject.
When a personal data subject asks the Operator to stop processing their personal data, processing stops within no more than 10 working days of the Operator receiving the request, except in cases provided for by the Personal Data Law. This period may be extended by no more than five working days. To do so, the Operator must send the personal data subject a reasoned notice stating the reasons for the extension.
When collecting personal data, including over the Internet, the Operator records, organizes, accumulates, stores, updates (refreshes, modifies) and retrieves the personal data of citizens of the Russian Federation using databases located in the Russian Federation, except in cases specified in the Personal Data Law. The Service's databases are hosted in a Selectel JSC data center in the Russian Federation.
The Operator does not transfer personal data across borders. Processing, including with document recognition and language model services, takes place in the Russian Federation.
To operate the Service, the Operator entrusts the processing of users' personal data, on the basis of a contract (Article 6(3) of the Personal Data Law), to the following persons:
- ООО «Дзета Технологии» (OOO “Dzeta Tekhnologii”, INN 9707059090): development and maintenance of the Service;
- Selectel JSC: hosting the information system in a data center in the Russian Federation;
- Russian document recognition and language model services that process data in the Russian Federation.

Updating, correcting, deleting and destroying personal data, responding to subjects' requests for access to personal data

The Operator provides the personal data subject or their representative with confirmation that personal data is being processed, the legal grounds and purposes of processing, and the other information specified in Article 14(7) of the Personal Data Law within 10 working days of the personal data subject or their representative contacting the Operator or of the Operator receiving their request. This period may be extended by no more than five working days. To do so, the Operator must send the personal data subject a reasoned notice stating the reasons for extending the deadline for providing the requested information.

The information provided does not include personal data relating to other personal data subjects, unless there are legal grounds for disclosing such personal data.

The request must contain:
- the number of the main identity document of the personal data subject or their representative, its date of issue and the issuing authority;
- information confirming the personal data subject's relationship with the Operator (contract number, contract date, a conventional verbal designation and/or other information), or information otherwise confirming that the Operator processes the personal data;
- the signature of the personal data subject or their representative.
The request may be sent as an electronic document signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator provides the information specified in Article 14(7) of the Personal Data Law to the personal data subject or their representative in the same form in which the request was sent, unless the request states otherwise.

If the request of the personal data subject does not contain all the information required by the Personal Data Law, or the subject has no right of access to the requested information, the subject is sent a reasoned refusal.

The personal data subject's right of access to their personal data may be restricted in accordance with Article 14(8) of the Personal Data Law, including where such access violates the rights and legitimate interests of third parties.
If inaccurate personal data is identified when the personal data subject or their representative contacts the Operator, or at their request or the request of Roskomnadzor, the Operator blocks the personal data relating to that personal data subject from the moment of such contact or receipt of the request for the period of verification, provided that blocking does not violate the rights and legitimate interests of the personal data subject or third parties.

If the inaccuracy of the personal data is confirmed, the Operator corrects the personal data within seven working days of receiving the relevant information, on the basis of information provided by the personal data subject, their representative or Roskomnadzor, or other necessary documents, and unblocks the personal data.
If unlawful processing of personal data is identified when the personal data subject, their representative or Roskomnadzor contacts the Operator, the Operator blocks the unlawfully processed personal data relating to that personal data subject from the moment of such contact or receipt of the request.
If the Operator, Roskomnadzor or another interested party identifies an unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has violated the rights of personal data subjects, the Operator:
- within 24 hours, notifies Roskomnadzor of the incident, its presumed causes, the presumed harm to the rights of personal data subjects and the measures taken to eliminate its consequences, and provides information about the person authorized by the Operator to interact with Roskomnadzor on matters related to the incident;
- within 72 hours, notifies Roskomnadzor of the results of the internal investigation of the incident and provides information about the persons whose actions caused it (if any).
Procedure for the destruction of personal data by the Operator.
1. Conditions and deadlines for the destruction of personal data by the Operator:
  - the purpose of processing personal data has been achieved or there is no longer a need to achieve it: within 30 days;
  - the personal data subject (or their representative) provides confirmation that the personal data was obtained unlawfully or is not necessary for the stated purpose of processing: within seven working days;
  - the personal data subject withdraws consent to the processing of their personal data, if storing it is no longer required for the purpose of processing: within 30 days.
2. When the purpose of processing personal data has been achieved, or when the personal data subject withdraws consent to its processing, the personal data must be destroyed unless:
  - otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor;
  - the operator is entitled to process the data without the personal data subject's consent on grounds provided for by the Personal Data Law or other federal laws;
  - otherwise provided by another agreement between the Operator and the personal data subject.
3. Personal data is destroyed by a commission established by order of the Company's General Director.
4. Depending on the type of medium (paper or electronic), personal data may be destroyed in one of two ways:
  - physical destruction of the medium (shredding);
  - erasure of the information from the medium or the personal data information system.
5. After personal data is destroyed, a Personal Data Destruction Certificate (hereinafter the Certificate) is drawn up and signed by the members of the commission.
6. Where the Operator processes personal data using automated tools, the documents confirming the destruction of personal data are the Certificate and an extract from the event log of the personal data information system.
7. The Personal Data Destruction Certificate and the log extract are kept for 3 years from the date the personal data is destroyed.

Operator details

Limited Liability Company Research and Production Association “Tsifrovoy kontur” (ООО НПО «Цифровой контур», OOO NPO “Tsifrovoy kontur”)
Taxpayer Identification Number (INN) / Tax Registration Reason Code (KPP): 7708458305 / 770801001
Primary State Registration Number (OGRN): 1267700032050
Registered address: 107140, Moscow, intracity territory of the Krasnoselsky Municipal District, 2/1 Verkhnyaya Krasnoselskaya Street, Building 2, Premises 1/1, Russia
Email: info@digital-contour.ru
Website: цифровой-контур.рф

Requests and inquiries about personal data processing can be sent to the Operator's email or registered address.