Version 2026-08-26. Effective date: 26 August 2026.
This Personal Data Processing Policy explains how Polina Stanislavovna Solonchukova, taxpayer identification number (INN) 773126173321, contact email: solo.polina@mail.ru processes and protects personal data of medrecord users.
This Policy is prepared with regard to Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”, personal data protection requirements, and guidance from Roskomnadzor.
The service is intended for uploading medical lab reports, extracting structured indicators, maintaining biomarker history, and receiving informational AI prompts. The service does not diagnose, prescribe treatment, or replace a doctor.
The operator may process service user data: email, name or display name, hashed password, subscription information, and technical session data.
When lab reports are uploaded, special categories of personal data related to health may be processed: laboratory indicators, test dates, laboratory names, units of measurement, reference values, abnormality statuses, and information the user independently includes in the uploaded file.
The service aims not to store source PDFs/images permanently: by default, a file is used to extract structured data, while personal identifiers in the text are masked or removed during technical processing.
Registration, user identification, and providing access to a personal account.
Uploading, recognizing, and structuring medical lab reports.
Displaying lab history, charts, biomarker trends, and informational prompts.
Ensuring service security, preventing abuse, maintaining technical logs, and auditing actions.
Communicating with the user about service operation, support, subscription, and account deletion.
General account data is processed on the basis of a separate personal data processing consent.
Special categories of health data are processed only after a separate health data consent. Acknowledging this Policy does not replace either consent.
Certain operations may be performed to fulfill the user agreement, comply with legal requirements, and protect the rights and legitimate interests of the operator and the user.
The user has the right not to provide data, but in that case registration, lab report upload, or certain service functions may be unavailable.
The operator may collect, record, systematize, accumulate, store, update, retrieve, use, transfer under instruction, depersonalize, block, delete, and destroy personal data.
Processing may be automated and mixed. Organizational and technical measures are used to protect data: access limitation, encryption or encoding of certain fields, password hashing, secure cookies, masking personal identifiers in AI context, and logging without raw IP addresses.
For the service to operate, data may be transferred to infrastructure, database, hosting, email, and AI/OCR providers where necessary for the stated purposes. Payment data is not processed until official billing is connected.
When contacting AI providers, the service aims to send minimal structured context without email, user name, internal identifiers, or raw file text, unless such transfer is required to recognize the document.
The operator does not sell personal data or disclose it to an unlimited group of persons. If publication or dissemination of personal data is required in the future, separate consent will be requested.
When collecting data of Russian citizens, recording, systematization, accumulation, storage, updating, and retrieval must initially use databases located in the Russian Federation where required by law.
A transfer to a foreign provider is allowed only after localization requirements, the legal basis, any required regulator notification, and confidentiality safeguards have been addressed. The operator verifies the production infrastructure before enabling health-data processing.
Necessary cookies are used for the secure session, sign-in, and saving settings. They are not used for advertising.
Product analytics is enabled only after a separate user choice and can be disabled at any time. Details and settings are available in the Cookie Policy.
Account data is stored until the user deletes the account or processing is terminated on a lawful basis.
Structured lab data is stored until deletion by the user, withdrawal of consent, termination of the account, or achievement of the processing purposes.
Source lab files are not stored permanently by default after processing, unless the user or service settings explicitly provide otherwise.
Upon withdrawal of consent, the operator stops processing and destroys the data within the periods required by law, unless there is another legal basis for continued processing.
The user has the right to receive information about the processing of their personal data, request correction, blocking, or destruction of data, withdraw consent, delete the account, and file a complaint with Roskomnadzor.
To make a request, contact the operator at solo.polina@mail.ru. It is recommended to include the account email and the nature of the request.
The operator may update this Policy when the service, processing activities, or legal requirements change. A new version takes effect from publication on this page unless stated otherwise.
The separate consent text is available on the Personal Data Processing Consent page. Health data is covered by a separate health data consent, while storage settings are described in the Cookie Policy.