Privacy Policy

Esteline LLC

Personal Data Protection Policy

The Personal Data Processing Policy of Esteline LLC (hereinafter "Company" or "we") has been developed in accordance with the Law of Georgia "On Personal Data Protection" and includes information about the data processed by the "Company", its categories, the rights of the data subject, the "Company's" obligations, the grounds and principles of data processing, data protection, and other matters related to personal data processing.

When using the "Company's" services, "we" will process your personal data, specifically:

Contact information (first name, last name, personal identification number, email address, phone number, residential address);
Date of birth;
Health status and diagnosis (when providing medical services);
Photo image (in certain cases);
Video image (video surveillance is carried out only in the hall and entrance area);
Audio monitoring (telephone calls only);
Banking information (in certain cases);
Data regarding insurance (where relevant).

The processing of the aforementioned data is carried out in compliance with the Law of Georgia "On Personal Data Protection" and is necessary for the purpose of providing services to you, as well as for the fulfillment of our obligations imposed by legislation regulating the medical field and other laws.

The "Company" processes the specified data on the following grounds:

Medical documentation for which we process your personal data, including special category personal data, is drawn up by the Ministry of Internally Displaced Persons from the Occupied Territories, Labor, Health and Social Affairs of Georgia (hereinafter the "Ministry"), and we are obligated to collect, protect, and, when necessary, submit it to the "Ministry" and its subordinate regulatory authority.
Data processing is necessary for providing you with medical and other services, contacting you, processing payments made by you, and enabling your use of insurance or bank installment plans
Data processing is necessary for protecting confidential information, property, and our legitimate interest (in the case of video surveillance);
Data processing is necessary to provide quality service to the customer (telephone call monitoring);
Data processing is mandatory to protect our legitimate interests and to confirm the services provided by us and their accuracy;
To provide you with comprehensive services.

Scope of Personal Data Processing

Personal data processing is carried out only to the extent necessary for providing services and fulfilling requirements of the legislation that regulates us.

Medical documentation is compiled by the Ministry of Internally Displaced Persons from the Occupied Territories, Labor, Health and Social Affairs of Georgia, which determines our necessity to request relevant personal data from you. In addition, processing data regarding diagnosis and health status is necessary to provide you with complete medical services.

Access to Personal Data

Only those employees whose involvement in the process is necessary to provide services to you have access to personal data: a) Medical personnel (the physician directly monitoring your health status, determining the diagnosis, and participating in the treatment process; the nurse assisting the physician in the process of providing service to you; the physician performing your laboratory research, if necessary); b) Administrative personnel who fill in your data, record them in the patient registry log (in accordance with the Ministry's requirements), receive payments from you, and contact you for consultation, scheduling, rescheduling, or follow-up); c) The clinical manager who may have access to medical documentation for audit purposes; d) The director and manager who may have access to video footage if viewing the recording becomes necessary upon the occurrence of any grounds for conducting video surveillance.

Since we carry out regulated activities, during the audit of our operations, access to your personal data may be held by the LEPL Medical and Pharmaceutical Regulation Agency, the Ministry, or another regulatory body, for the purpose of fulfilling obligations imposed on us by law.

In addition to the above, your personal data may be transferred to a third party as necessary for providing services to you (for example, it may be included in an invoice to be submitted to a bank to obtain installment financing; transferred to an insurance company to reimburse services provided by us; or to a transport/courier company if goods are being delivered to you, etc.).

Personal Data Security

Any employee who may handle your personal data is bound by confidentiality terms, the violation of which may serve as grounds for termination of their employment relationship.

Medical documentation is stored in cabinets designated specifically for this purpose, and only authorized personnel have access to them.

The patient's photo image is saved on an independent drive kept by the physician, and only the relevant physician has access to it. Other employees do not have physical or network access to these photos. Any physician capturing or receiving media depicting a patient's image using a personal device is strictly warned that photo/video material must be transferred without unreasonable delay to our company-owned device, which is password-protected and accessible only to relevant medical personnel. Violation of this rule may serve as grounds for termination of employment, which is well known to our employees.

We take measures to deepen and update employee knowledge and periodically test their understanding of personal data processing, as well as perform periodic monitoring of data processing rules.

In branches where semi-automated data processing takes place, the person authorized to process data is FINA LLC, Identification Code: 404407968. According to the agreement concluded between the company and "us", the specified company processes data solely for providing software maintenance services specified in the contract. Service provision includes all actions to be performed by the company under the agreement, specifically software support of the database, ensuring smooth operation, storage, deletion, and destruction.

Data storage is carried out on the servers of UGT LLC, Identification Code: 204892964, which holds the international security management standard certificate ISO/IEC 27001:2022. Additional security measures taken by the company can be reviewed here: https://ugt.ge/services/cloud-services/services-cloud-services-dedicated-servers/.

Data Retention Period

Personal data is retained only for the period necessary for the purposes of processing such data. The period provided by legislation regulating the storage of outpatient medical documentation is 5 years. Video recordings are stored for 30 days, after which they are destroyed by overwriting with new recordings. Other personal data processing (retention) is carried out for a period of 3 years.

Your Rights

You have the right to:

Receive information at any time about whether any data about you is being processed, what information is processed, for what duration, and so on. We are obligated to provide you, upon request, with any information regarding personal data kept on you and its processing;
Review your personal information processed by us and obtain a copy of it;
Request the correction, updating, or completion of inaccurately/incompletely/erroneously processed personal data;
Request the termination, deletion, or destruction of data processing;
Request data blocking, which implies the temporary suspension of processing;
Withdraw your granted consent.

Any of the mentioned rights may be restricted in cases directly provided by law.

Furthermore, if you believe that we have violated any of your rights granted under the Law of Georgia "On Personal Data Protection", you have the right to appeal to the Personal Data Protection Service, to a court, and/or to a higher administrative authority.

The "Company" periodically provides certain information to its customers via direct marketing. By receiving services, you agree to receive such offers from "us"; however, you reserve the right to withdraw your consent at any time via the simplest available method — by replying to an SMS, via a telephone call, through email, or by written application on-site. In such cases, the processing of your personal data for direct marketing purposes will cease upon the effective date of your refusal.

Data Controller

Esteline LLC

2 914 914

info.gvaramia@gmail.com

Tbilisi, 1 Al. Kazbegi Ave.