This document is not yet available in this language. The English version is shown.
PRIVACY POLICY
QazMedAI mobile application
Version 1. Effective date: October, 2026
1. General Provisions
1.1. This Privacy Policy (the "Policy") explains what personal data is collected and processed in the QazMedAI mobile application (the "App"), for what purposes, how it is protected, and what rights users have.
1.2. The owner (rights holder) of the App, the personal data operator, the developer and the technical support provider of the App is Medical Research Projects LLP, BIN 070340003817 (the "Operator").
1.3. The App is designed for members of the Republican Public Association "Sectoral Trade Union of Workers of Medicine and Related Industries "QAZMED"" (the "Union"). Authorized Union specialists handle user requests as described in Section 7.
1.4. This Policy has been prepared in accordance with Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection" dated May 21, 2013, other laws and regulations of the Republic of Kazakhstan, and the requirements of the App Store and Google Play.
1.5. By registering in and using the App, the user confirms that they have read this Policy and consent to the collection and processing of their personal data on the terms set out herein. If the user does not agree with this Policy, they must stop using the App.
2. Operator Contact Details
Medical Research Projects LLP, BIN 070340003817
Address: apt. 53, bldg. 33, Aksai-3 microdistrict, Auezov district, Almaty, Republic of Kazakhstan
Person responsible for organizing personal data processing: Bauyrzhan Yerzhanov, tel. +7 701 783 0836, e-mail: yerzhanov.bauyrzhan@gmail.com
Website: https://mrpastana.com/
User support: e-mail yerzhanov.bauyrzhan@gmail.com, tel. +7 701 783 0836
3. Data We Process
We follow the principle of data minimization. The App does not ask for the user's name, IIN (individual identification number), date of birth, home address, place of work or other profile data.
3.1. Mobile phone number — for registration, sign-in with a one-time SMS code, and verification of Union membership against the membership register provided by the Union or of an active subscription.
3.2. Information the user provides voluntarily:
the text of digital requests to the Union and photos and files attached to them;
anonymous feedback messages;
a request for a call from a psychotherapist: a phone number for contact and, at the user's discretion, a brief description of the request. Such information may constitute health information and is provided strictly on a voluntary basis.
The user decides what information to provide. Please do not include personal data of third parties in requests, including data that could identify patients.
3.3. Queries to the AI assistants. Text and voice queries are processed solely to generate a response. Conversations with the AI assistants are not stored on servers and are not used to train models. Voice input is converted to text on the Operator's server in the Republic of Kazakhstan; audio recordings are not stored.
3.4. Technical data: a device identifier for delivering push notifications (Firebase Cloud Messaging token), device model, operating system and App version, IP address, date and time of server requests, and error logs. This data is needed to operate the App, deliver notifications and ensure security.
3.5. Subscription information. For users who are not Union members, the Operator receives from Apple or Google only information about the status and term of the subscription. Payment data (card number, etc.) is processed by Apple or Google; the Operator neither receives nor stores it.
3.6. We do not collect location data, contacts, biometric data or advertising identifiers; we do not show ads and do not track users across other apps or websites.
3.7. Reports on AI responses. If the user taps the "Report" button under an AI assistant response, the text of that response, the query that produced it and the reason for the report are sent to the Operator solely to review and fix errors. This information is kept for no more than 90 (ninety) calendar days and is not used to train the model.
4. Device Permissions
The App requests access only to the device features needed for it to work, and only when the user takes an action:
camera and photos — to attach a photo or file to a request;
microphone — for voice input; recording takes place only while the user is pressing or holding the voice input button;
notifications — for replies to requests, Union news and announcements.
Permissions can be revoked at any time in the device settings. In that case the corresponding feature becomes unavailable, while the rest of the App continues to work.
5. Purposes of Processing
registration, sign-in, verification of Union membership or subscription;
operation of the AI assistants (legal, ICD, clinical protocols, psychological support);
receiving and handling digital requests by Union specialists and sending replies;
receiving anonymous feedback and helping the user;
arranging contact between the user and a psychotherapist at the user's request;
sending Union news and announcements;
preparing anonymized analytics for the early detection of systemic problems by region and medical organization;
ensuring security, preventing abuse and fixing errors;
complying with the laws of the Republic of Kazakhstan.
6. Legal Basis for Processing
6.1. Personal data is processed on the basis of the user's consent, given electronically when registering in the App, to perform the Terms of Use, and in other cases provided for by the laws of the Republic of Kazakhstan.
6.2. Health information contained in a request for a call from a psychotherapist is processed only with the user's separate consent, given when the request is submitted.
6.3. The user may withdraw consent by sending a request to the contacts listed in Section 2. Withdrawal of consent may make further use of the App impossible.
7. Who Has Access to Data
7.1. Digital requests and anonymous feedback are accessible only to authorized specialists of the Union's central office. They are not shared with the Union's territorial or primary organizations, the user's employer, or the management of the medical organization.
7.2. Anonymity of feedback means that the user's identity is hidden from the employer and any third parties. The Union can see who the author is so that it can contact and help them. The author's identity is disclosed to others only with the user's explicit consent or where expressly required by law.
7.3. The psychotherapist receives the phone number and description of the request only after the user submits a request and is bound by medical confidentiality.
7.4. Operator staff have access to data only to the extent necessary for technical support and operation of the App and are bound by confidentiality obligations.
7.5. The Union's central online dashboard contains only anonymized, aggregated data that cannot be used to identify a user. Access is limited to an administrator and an analyst with the appropriate permissions. Anonymized data is not shared with any third parties.
7.6. Third-party services necessary for the App to work:
Google Firebase (Firebase Cloud Messaging) — delivery of push notifications;
Apple (App Store) and Google (Google Play) — subscription purchases and management;
SMSC.kz — delivery of one-time SMS codes (the phone number and code are transmitted).
7.7. Data may be provided to government authorities only in the cases and in the manner provided for by the laws of the Republic of Kazakhstan.
7.8. We do not sell personal data or share it with third parties for advertising or marketing.
8. Data Storage and Localization
8.1. Personal data is stored in a database hosted on servers located in the Republic of Kazakhstan (Hoster.KZ Company LLP). The language model behind the AI assistants (Qwen, 14 billion parameters) runs on the Operator's server in the Republic of Kazakhstan; user queries are not sent to external AI services.
8.2. To deliver push notifications, the device token and technical data are transmitted via Google Firebase, whose servers may be located outside the Republic of Kazakhstan. Phone numbers and the content of requests and feedback are not transmitted via Firebase.
8.3. Retention periods:
data of a Union member is kept for the duration of membership; when membership ends, all of the user's data is deleted within 30 (thirty) calendar days after the Operator receives notice of this from the Union;
data of a subscriber is kept while the subscription is active and is deleted within 30 (thirty) calendar days after it ends, unless the subscription is renewed;
conversations with the AI assistants are not stored;
technical logs are kept for no more than 90 (ninety) calendar days;
anonymized aggregated data may be kept longer, as it does not allow identification.
Data may be kept longer than these periods only where expressly required by the laws of the Republic of Kazakhstan.
9. Data Protection
The Operator takes legal, organizational and technical measures to protect personal data, including encryption of data in transit (TLS), access control and permission management, logging of data access, backups, and internal personal data protection policies. No method of transmission or storage is completely secure, but we do everything reasonably possible to prevent unauthorized access.
10. User Rights
Under the laws of the Republic of Kazakhstan, the user has the right to:
know whether the Operator holds their personal data and receive information on the purposes, methods and periods of its processing;
request that their personal data be changed or supplemented;
request that their personal data be blocked where there are grounds to do so;
request the destruction of personal data processed in violation of the law;
withdraw consent to the processing of personal data, except in cases provided for by law;
appeal against the Operator's actions (or inaction) to the authorized personal data protection body or to a court.
To exercise these rights, the user should send a request to yerzhanov.bauyrzhan@gmail.com stating the phone number linked to their account. The Operator may verify the requester's identity (for example, with an SMS code) and will respond within the time limits established by the laws of the Republic of Kazakhstan.
11. Deleting Your Account and Data
11.1. In the App. The user can delete their account in the App at any time: "Profile" → "Delete account". After confirmation, access to the account ends immediately, and all related personal data (phone number, requests, attachments, feedback, call requests) is deleted within 30 (thirty) calendar days.
11.2. Without access to the App. If the App has already been removed from the device, a deletion request can be submitted at https://mrpastana.com/ or sent to yerzhanov.bauyrzhan@gmail.com stating the phone number of the account. The Operator confirms the request with an SMS code.
11.3. When a user leaves the Union, the account and data are deleted automatically within the period specified in Section 8.3.
11.4. After deletion, only anonymized aggregated data that cannot identify the user is retained, together with information whose retention is expressly required by the laws of the Republic of Kazakhstan, for the period those laws set.
11.5. Deleting an account does not end Union membership. Deleting the account or the App does not cancel a paid subscription — it must be cancelled in the Apple ID or Google Play settings.
12. Age Restriction
The App is intended only for persons over 18 years of age. We do not knowingly collect data from minors. If we learn that an account was created by a minor, it will be deleted.
13. Changes to this Policy
The Operator may amend this Policy. The new version is published in the App and on https://mrpastana.com/ and takes effect upon publication unless otherwise stated. Users are notified of material changes in the App. Continued use of the App after changes means acceptance of the new version.
14. Language Versions
This Policy is made in Kazakh, Russian and English. In the event of any discrepancy between the texts, the Russian text prevails.