Privacy Policy

1.1. This Privacy Policy (hereinafter, the "Policy") establishes how personal data of users of the schoolofmedicine.uz website (hereinafter, the "Platform") is processed and protected.

1.2. The Policy has been developed in accordance with Law of the Republic of Uzbekistan No. ZRU-547 dated July 2, 2019, "On Personal Data" (as amended) and other applicable legislation of the Republic of Uzbekistan.

1.3. By using the Platform, registering on it, and/or purchasing educational services, the User confirms having read this Policy.

1.4. The Policy applies to personal data processed when using the Platform and the Operator's related services: the authentication service, the learning management system (LMS), and the payment module.

2.1. The personal data operator is:

2.2. The authentication service, the LMS (Moodle), and the file storage are the Operator's own infrastructure components and are hosted on its server.

3.1. Account and profile data: first name, last name, e-mail address; and, where provided by the User, phone number, specialty, workplace, city, and preferred interface language.

3.2. Documents confirming medical professional status, uploaded by the User to obtain access to course purchases: a copy of an identity document; medical education diploma(s); a personal information sheet ("obyektivka"); an employment certificate; as well as the User's notes on the files and technical file details (name, type, size).

3.3. Order and payment data: order number, selected course, amount and currency, payment service used, payment status, and payment identifiers assigned by the payment service.

3.4. Learning data: information about course access granted, the LMS account, and learning progress data in the LMS.

3.5. Technical data: IP address and browser details in web-server logs; cookies required for sign-in and session operation; action-log records (for example, that a document was uploaded, an order created, a payment started and confirmed), including the record of Public Offer acceptance when proceeding to payment.

3.6. The Operator does not process special categories of personal data, biometric data, or genetic data. The Platform is not intended for uploading or storing information about patients, diagnoses, or other patient medical data, and contains no such functionality.

3.7. Bank card data is not processed or stored by the Operator: payment details are entered on the payment service's page.

• from the User — during registration, completing the profile, uploading documents, and submitting requests;
• automatically — when the Platform is used (technical data and logs);
• from the payment service — payment statuses and identifiers for the User's order.

5.1. Personal data is processed for the following purposes:

• creating an account, authentication, and operation of the personal account;
• entering into and performing the agreement for the provision of educational services, including granting access to paid courses;
• confirming medical professional status as a condition of access to course purchases;
• receiving and recording payment, confirming transactions, and resolving disputes;
• sending service notifications necessary for performance of the agreement;
• ensuring security, preventing abuse, and keeping action logs;
• fulfilling obligations imposed on the Operator by law.

5.2. Marketing mailings are not currently sent. If introduced, they will be sent only where there is an appropriate legal basis and/or the User's consent.

6.1. The legal bases of processing are: entering into and performing an agreement to which the User is a party (the Public Offer); compliance with the legislation of the Republic of Uzbekistan; and the User's consent — where processing is based on consent.

6.2. Consent to the processing of uploaded documents is recorded separately at upload time — together with the version of the consent text and the time it was given.

6.3. The Public Offer acceptance made when proceeding to payment is recorded in the action log with the language, offer revision, and time.

7.1. Registration and sign-in are performed through the Operator's own authentication service (Keycloak) using the OpenID Connect protocol.

7.2. The password is set and verified only in the authentication service and is stored in protected form; the Platform application does not receive or store passwords.

7.3. Technically necessary cookies are used to maintain the signed-in state (Section 11).

8.1. Learning materials, assignments, and progress records are kept in the Operator's LMS (Moodle), hosted on its own infrastructure (lms.schoolofmedicine.uz).

8.2. To grant access to a paid course, a User account is created in the LMS automatically: a service username, first name, last name, and e-mail address.

8.3. The LMS is accessed through the Platform's single sign-on (SSO); no separate LMS password is used.

9.1. When an order is placed, the selected course, the price according to the Platform, and the order number are recorded.

9.2. Payment is made through the payment services available on the Platform at the time of payment (currently — Click). The payment service receives the order number and the amount; the User enters payment details on the payment service's page, and they are not available to the Operator.

9.3. The payment service is independently responsible for processing the data the User provides to it during payment, in accordance with its own rules.

10.1. To obtain access to course purchases, the User uploads the documents listed in clause 3.2 and confirms consent to their processing.

10.2. Document files are kept in the Operator's private file storage. No public links to the files are created; access to the files is granted only to the Operator's authorized personnel for review purposes.

10.3. Actions on documents (upload, opening, review decision) are recorded in the action log.

11.1. The Platform uses only technically necessary cookies: session and request-forgery-protection cookies, and short-lived cookies of the sign-in process; the authentication service also sets its own cookies. Such cookies last for the session or for a short time during sign-in.

11.2. Analytics, advertising, and other tracking cookies are not used; there are no external counters or trackers on the Platform.

11.3. The browser may keep a service record used to synchronize the signed-in state between tabs; it contains no personal data.

11.4. The interface language is determined by the page address and is not stored in a cookie.

11.5. The Operator's web server keeps request logs (IP address, time, requested address, browser details) for security and to keep the Platform operational.

12.1. Personal data is disclosed to third parties only to the extent necessary for the purposes listed in Section 5:

• to the payment service (Click) — the order number and amount when proceeding to payment;
• to the e-mail delivery service (Brevo) — the recipient's address and the content of a service message when it is sent;
• to the hosting provider — by virtue of hosting the Operator's server infrastructure.

12.2. Personal data is not sold and is not disclosed to third parties for advertising purposes.

12.3. Data is disclosed to state authorities only in the cases and in the manner established by law.

12.4. Links to external services (map services, Telegram) are opened at the User's initiative; upon following such a link, data is processed by the respective external service.

13.1. Personal data is processed and stored on the Operator's server, hosted with a hosting provider in the Republic of Uzbekistan.

13.2. Service e-mails are delivered using Brevo (Sendinblue SAS, France): when a message is sent, the recipient's address and the message content are processed by that service. Such transfer is limited to what is necessary to send the message and is carried out in compliance with the requirements of the legislation of the Republic of Uzbekistan on cross-border transfer of personal data.

13.3. Biometric and genetic data subject to mandatory storage within the Republic of Uzbekistan is not processed by the Operator.

14.1. Personal data is processed until the purposes of processing are achieved: account and profile data — for as long as the User's account exists; order and payment data and transaction logs — for the periods necessary to confirm settlements and fulfill obligations established by law; medical professional verification documents — for as long as the User's access to training remains valid, or until the User's deletion request is satisfied, unless further storage is required by law.

14.2. Once the purposes of processing are achieved and the periods established by law expire, personal data is subject to destruction or anonymization.

15.1. The Operator applies organizational and technical protection measures, including:

• role-based access to data, limited to authorized personnel;
• encrypted connections (HTTPS/TLS);
• private document file storage with no public links;
• password storage only in the authentication service, in protected form;
• action logs that do not allow records to be modified;
• restricted access to the server infrastructure.

16.1. In accordance with the Law of the Republic of Uzbekistan "On Personal Data", the User has the right to:

• obtain information about the processing of their personal data;
• demand that their personal data be clarified (corrected);
• demand that processing be stopped and the data destroyed where legal grounds exist;
• withdraw consent to processing — with respect to processing based on consent;
• appeal against the Operator's actions or inaction to the authorized state body or a court.

16.2. Stopping the processing of certain data may make it impossible to continue providing services that require such data; this does not affect processing that is mandatory under the law.

17.1. Requests concerning personal data are sent to the Operator using the contact details in Section 19, stating the full name, the account e-mail address, and the substance of the request.

17.2. The period for considering a request is 10 business days, unless another period is established by law.

17.3. Requests sent by e-mail are processed by the mail service that serves the stated address.

18.1. The Operator may amend this Policy by publishing a new version on the Platform. The current version is available at: https://schoolofmedicine.uz/en/privacy.

18.2. Continued use of the Platform after changes take effect means that the User has read the new version.