Home  /  Personal data

Personal data processing policy

The full text is below. In short — three things worth knowing before you send a form

Only what we needYour name, one contact and — if you took the quiz — your answers. No ID, address or card details are ever asked for
Never soldSeen only by the clinic’s front desk and the services we cannot process an enquiry without. No mailing lists
Deleted on requestOne email, and within 30 days your data is gone

Revised 1 September 2026 · Russian Federal Law No. 152-FZ

This is a courtesy translation. The legally binding version is the Russian text; where the two differ, the Russian text prevails.

01

General provisions

1.1. This Personal Data Processing Policy (the “Policy”) is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Personal Data Law”) and sets out how personal data is processed, and what security measures are taken, by Lazer Limited Liability Company (the “Operator”).

1.2. Operator: Lazer LLC (RE/FACE clinic), INN 2700033608, OGRN 1242700010321, address: 49 Turgeneva St, premises I (22–26, 135–140), Khabarovsk, Khabarovsk Krai, 680000, Russia. Medical services are provided under license Л041-01189-27/04977546 issued by the Ministry of Health of Khabarovsk Krai. Email for personal data enquiries: refaceclinickhv@gmail.com.

1.3. The Operator regards respect for human and civil rights and freedoms in the processing of personal data — including the right to privacy and to personal and family secrecy — as its foremost goal and a condition of its activity.

1.4. The Policy applies to all information the Operator may obtain about visitors of the website https://re-face.ru, including its English version, and about persons who submit an enquiry through the website forms.

1.5. The Policy is published at https://re-face.ru/privacy and is linked from every page of the website where personal data is collected.

02

Definitions used in the Policy

  • Automated processing of personal data — processing of personal data by means of computer technology.
  • Blocking of personal data — temporary suspension of processing (except where processing is needed to update the data).
  • Website — the graphic and information materials, computer programs and databases made available on the Internet at https://re-face.ru.
  • Personal data information system — the personal data contained in databases together with the information technologies and technical means used to process it.
  • Anonymisation — actions after which it is impossible, without additional information, to attribute personal data to a specific User or other data subject.
  • Processing of personal data — any operation or set of operations performed on personal data with or without automated means, including collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction.
  • Operator — a legal entity that, alone or jointly with others, organises and/or carries out the processing of personal data and determines its purposes, the scope of data and the operations performed on it.
  • Personal data — any information relating directly or indirectly to an identified or identifiable User of the Website.
  • Personal data authorised for dissemination — personal data to which the data subject has granted access to an unlimited number of persons by giving separate consent under the Personal Data Law.
  • User — any visitor of the Website.
  • Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
  • Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons.
  • Cross-border transfer — transfer of personal data to the territory of a foreign state, to a foreign public authority, foreign individual or foreign legal entity.
  • Destruction of personal data — actions after which personal data is irreversibly destroyed and cannot be restored in the information system, and/or physical media containing it are destroyed.
03

Rights and duties of the Operator

3.1. The Operator has the right to:

  • obtain from the data subject accurate information and/or documents containing personal data;
  • where the data subject withdraws consent or demands that processing cease, continue processing without consent where the Personal Data Law provides grounds for doing so;
  • independently determine the set of measures necessary and sufficient to fulfil the duties imposed by the Personal Data Law and the regulations adopted under it.

3.2. The Operator is obliged to:

  • provide the data subject, at their request, with information about the processing of their personal data;
  • organise the processing of personal data as required by the current legislation of the Russian Federation;
  • respond to requests from data subjects and their legal representatives within 10 business days of receipt (this may be extended by no more than 5 business days with a reasoned notice to the data subject);
  • provide the authorised body for the protection of data subjects’ rights (Roskomnadzor) with the information it requests within 10 business days of the request;
  • notify the authorised body of any unlawful or accidental transfer of personal data within the time limits set by the Personal Data Law;
  • publish or otherwise provide unrestricted access to this Policy;
  • take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;
  • cease the transfer (dissemination, provision, access) of personal data, cease processing and destroy personal data in the manner and cases provided for by the Personal Data Law;
  • perform other duties provided for by the Personal Data Law.
04

Rights and duties of data subjects

4.1. Data subjects have the right to:

  • receive information about the processing of their personal data, except in cases provided for by federal law;
  • require the Operator to update, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose, and to take the measures provided by law to protect their rights;
  • require prior consent as a condition for processing personal data for the purpose of promoting goods, works and services on the market;
  • withdraw consent to the processing of personal data and demand that processing cease;
  • appeal to Roskomnadzor or to a court against unlawful acts or omissions of the Operator in processing their personal data;
  • exercise other rights provided for by the legislation of the Russian Federation.

4.2. Data subjects are obliged to:

  • provide the Operator with accurate information about themselves;
  • inform the Operator of any updates or changes to their personal data.

4.3. Persons who provide the Operator with inaccurate information about themselves, or with information about another data subject without that person’s consent, are liable under the legislation of the Russian Federation.

4.4. The Website is not intended for persons under 18. If you are under 18, an enquiry to the clinic is made by your legal representative.

05

Processing principles

  • 5.1. Personal data is processed lawfully and fairly.
  • 5.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is not permitted.
  • 5.3. Databases containing personal data processed for incompatible purposes are not merged.
  • 5.4. Only personal data that meets the purposes of processing is processed.
  • 5.5. The content and scope of processed personal data correspond to the stated purposes. Excessive processing relative to the stated purposes is not permitted.
  • 5.6. Processing ensures the accuracy, sufficiency and, where necessary, relevance of personal data to the purposes of processing. The Operator takes the necessary measures to delete or update incomplete or inaccurate data.
  • 5.7. Personal data is stored in a form that allows the data subject to be identified for no longer than the purposes of processing require, unless a retention period is set by federal law or contract. Personal data is destroyed or anonymised once the purposes of processing are achieved or no longer need to be achieved.
06

Purposes, scope and legal grounds of processing

6.1. Purposes of processing:

  • contacting the User about their enquiry — a call back or a message in the messenger the User selected, and booking a consultation or appointment;
  • preparing personal recommendations from the answers the User voluntarily gave in the questionnaire (quiz) on the Website;
  • keeping a history of enquiries so that the same information is not requested twice;
  • concluding and performing a contract for paid medical services;
  • considering a job application submitted through a form on the Website and contacting the candidate;
  • anonymised statistics of Website traffic and improvement of the Website;
  • sending informational and promotional messages — solely on the basis of the User’s separate consent (at the date of this Policy the Operator runs no mailings);
  • protecting the rights and legitimate interests of the Operator.

6.2. Categories of data subjects:

  • visitors of the Website;
  • persons who have submitted an enquiry through the Website forms;
  • patients of the clinic who contacted it via the Website.

6.3. Personal data processed:

Nameas entered by the User in the form
Contact detailsphone number, email address, Telegram or MAX handle, preferred contact method — whichever the User provided
Questionnaire (quiz) answersage range, skin type, aesthetic goals and concerns about skin or hair, treatment experience — only if the User took the quiz and gave these voluntarily
Enquiry detailsthe Website page and form the enquiry was sent from, date and time
Technical dataIP address, cookies, browser and device information, referrer, on-site actions — collected by the analytics service in anonymised form (see section 12)

Through the Website the Operator does not collect identity document details, health information to the extent of medical records, or payment details. Questionnaire answers are used solely to prepare a consultation; health information is processed for medical purposes at the clinic on the basis of separate written consent and a contract.

6.4. Legal grounds for processing:

  • Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;
  • Federal Law No. 323-FZ of 21 November 2011 “On the Fundamentals of Public Health Protection in the Russian Federation”;
  • Rules for the provision of paid medical services by medical organisations, approved by Decree of the Government of the Russian Federation No. 736 of 11 May 2023;
  • contracts concluded between the Operator and the data subject;
  • the data subject’s consent to the processing of their personal data (Art. 9(1) of the Personal Data Law);
  • the Operator’s constituent documents.

6.5. Types of processing:

  • collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction of personal data;
  • mixed processing — with and without automated means, with and without transmission over telecommunications networks;
  • transfer of personal data to persons processing it on the Operator’s behalf (see clause 8.3).
07

Conditions of processing

  • 7.1. Personal data is processed with the data subject’s consent.
  • 7.2. Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, or to perform functions, powers and duties imposed on the Operator by the legislation of the Russian Federation.
  • 7.3. Processing is necessary for the administration of justice or the enforcement of a judicial act or an act of another body or official enforceable under the legislation on enforcement proceedings.
  • 7.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to conclude a contract at the data subject’s initiative.
  • 7.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant purposes, provided the data subject’s rights and freedoms are not violated.
  • 7.6. Processing of personal data to which the data subject has granted access to an unlimited number of persons, or at their request (publicly available personal data).
  • 7.7. Processing of personal data subject to publication or mandatory disclosure under federal law.
08

Collection, storage, transfer and other processing

8.1. The security of personal data is ensured through legal, organisational and technical measures required to comply in full with personal data protection legislation.

8.2. The Operator safeguards personal data and takes all possible measures to prevent access by unauthorised persons: data sent from the Website is protected by HTTPS; only authorised staff with individual accounts have access to enquiry-management systems; a person responsible for organising personal data processing has been appointed; internal regulations on the processing and protection of personal data have been adopted.

8.3. The User’s personal data is not transferred to third parties, except where required by law and except for transfer to persons processing data on the Operator’s behalf under contracts and subject to confidentiality:

amoCRMenquiry management and history of communication with the User
YClientsonline booking and the clinic schedule, if the User books themselves
Yandex Metrica (Yandex LLC)anonymised Website traffic statistics; the User’s name and contacts are not passed to the service
Callibricall source tracking: the service displays one of the clinic’s dedicated phone numbers on the Website and links the incoming call to the Website visit
Hosting providerhosting of the Website and the enquiry service on servers located in the Russian Federation

8.4. If personal data is found to be inaccurate, the User may update it by sending the Operator a notice to refaceclinickhv@gmail.com marked “Personal data update”.

8.5. The processing period is determined by the achievement of the purposes for which the data was collected, unless a different period is set by contract or law. Enquiry data of Users who did not become patients is kept for no more than three years from the last interaction. Patient records are kept for the periods set for medical documentation.

8.6. The User may withdraw consent at any time by sending the Operator a notice to refaceclinickhv@gmail.com marked “Withdrawal of consent to personal data processing”, or in writing to the Operator’s address. The Operator ceases processing and destroys the personal data within 30 days of receiving the withdrawal, unless otherwise provided by contract or law.

8.7. Information collected by third-party services (communication tools, online booking services and other providers) is stored and processed by those parties in accordance with their own terms of use and privacy policies.

8.8. Prohibitions set by the data subject on the transfer, processing or conditions of processing of personal data authorised for dissemination do not apply where processing is carried out in state, public or other public interests defined by the legislation of the Russian Federation.

8.9. Processing may be terminated when the purposes of processing are achieved, the consent expires, the data subject withdraws consent or demands that processing cease, or unlawful processing is identified.

09

Processing operations performed by the Operator

9.1. The Operator collects, records, systematises, accumulates, stores, updates, retrieves, uses, transfers (provides, grants access to), anonymises, blocks, deletes and destroys personal data.

9.2. The Operator processes personal data by automated means, with or without receiving and/or transmitting the information over telecommunications networks.

10

Cross-border transfer of personal data

10.1. Databases containing the personal data of Website Users are located in the Russian Federation. The Operator does not carry out cross-border transfer of personal data.

11

Confidentiality of personal data

The Operator and other persons who have obtained access to personal data must not disclose it to third parties or disseminate it without the data subject’s consent, unless otherwise provided by federal law.

12

Cookies and analytics

12.1. The Website uses cookies and similar technologies to operate and to analyse traffic. Cookies are small text files stored on the User’s device.

12.2. For statistics the Website uses Yandex Metrica (Yandex LLC), including the Webvisor tool, which records the User’s actions on pages (cursor movement, scrolling, clicks) in anonymised form. Form field contents are masked; the User’s name and contacts are not passed to the analytics service.

12.3. The Website uses the Callibri call tracking service: a visitor is shown one of the phone numbers assigned to the clinic, and the incoming call is linked to the Website visit — the referral source, the page and the time of the visit. This lets the Operator see which pages bring enquiries. The service does not analyse the content of the conversation.

12.4. Cookies are not used to show the User advertising on third-party resources.

12.5. The User may disable cookies in their browser settings or use private browsing; this may affect certain Website functions. By continuing to use the Website after seeing the cookie notice, the User confirms consent to their use.

13

Requests from data subjects

13.1. Requests for information, correction, blocking or destruction of personal data, and withdrawal of consent, are sent to the Operator at refaceclinickhv@gmail.com or in writing to: 49 Turgeneva St, premises I (22–26, 135–140), Khabarovsk, Khabarovsk Krai, 680000, Russia.

13.2. A request should contain information that identifies the applicant and their relationship with the Operator (for example, the phone number or email address given in the enquiry), the substance of the request and, for written requests, a signature.

13.3. The Operator responds within 10 business days of receiving the request. This may be extended by no more than 5 business days with a reasoned notice to the applicant.

13.4. If the User believes the Operator is processing their personal data unlawfully, they may apply to Roskomnadzor or to a court.

Email the Operator +7 929 410-88-55 →
14

Final provisions

14.1. The User may obtain clarification on any matter concerning the processing of their personal data by contacting the Operator at refaceclinickhv@gmail.com.

14.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy remains in force indefinitely until replaced by a new version.

14.3. The current version of the Policy is available at https://re-face.ru/privacy. The text of the consent to personal data processing that the User gives when submitting the Website forms is available at https://re-face.ru/en/consent.