Home
Privacy Policy

iya clinic

Privacy Policy

03.12.2025

Privacy Policy – version dated March 9, 2026. Approved by individual entrepreneur Brodska A.P.

General provisions

1.1. This Privacy Policy (hereinafter referred to as the “Policy”) establishes the procedure for processing, storing, using and disclosing personal data provided to individuals (hereinafter referred to as the “Personal Data Subject”) in connection with the activities of the Aesthetic Medicine Clinic IYA CLINIC (by Anna Brodska) (hereinafter referred to as the “Clinic”), in accordance with the Law of Ukraine “On Personal Data Protection” and other regulatory legal acts of Ukraine.

The owner of personal data is the Individual Entrepreneur Brodska Anna Petrovna, who operates under the commercial name “IYA CLINIC (by Anna Brodska)” and determines the purpose and methods of processing personal data.

1.2. The Clinic processes personal data exclusively within the scope and for the purpose of performing its activities, in particular regarding the provision of aesthetic medicine and cosmetology services, including cosmetic procedures, skin care, rejuvenation, using modern aesthetic medicine techniques with an emphasis on patient comfort and safety.

1.3. The Visitor’s provision of information on the Site confirms his/her familiarization with the content of this Privacy Policy. The processing of the Visitor’s personal data by the Clinic is carried out in accordance with this Policy on the grounds and for the purposes specified by the legislation of Ukraine, in particular for the purpose of providing consultations/procedures to which the Visitor is a party, as well as for the fulfillment of the legal obligations imposed on the Clinic.

1.3.1. The processing of personal data for the purposes of marketing, analytics, the use of optional cookies and other purposes that are not necessary for the functioning of the Site or the provision of services is carried out exclusively with the separate consent of the Visitor, provided by taking active actions provided for by the functionality of the Site, with the possibility of withdrawing such consent at any time.

1.4. This Privacy Policy is an integral part of the terms of use of the Site, concluded between the visitor (hereinafter referred to as the “User”) and the Clinic of Aesthetic Medicine IYA CLINIC (by Anna Brodska) regarding the use of the site: https://iyaclinic.com/ (hereinafter referred to as the “Site”).

1.5. When any individual visits the Site, the Clinic receives certain information about him. This Privacy Policy (hereinafter referred to as the “Policy”) applies when an individual:

visits our site;
registers on the Clinic’s website for the purpose of receiving consultations/procedures;
makes an appointment with a doctor through the Site;
receives medical and aesthetic cosmetic procedures services specified on the Clinic’s website;
subscribes to news, newsletters, informational or promotional materials of the Clinic;
leaves reviews, comments or other public messages on the Site or related resources;
addresses the Clinic with requests, complaints, applications or other requests via feedback forms, e-mail, social networks, telephone and others;
provides personal data in another way for the purpose of communication, obtaining consultations or information about the Clinic’s activities or services.
interacts with the Site using cookies and other tracking technologies;
uses the Site’s functionality in any other way in accordance with the terms of its use.

1.6. This Policy determines the types of information and personal data that the Clinic receives from Visitors to the Clinic’s site, the procedure for their collection, processing and use. Information and personal data are collected, processed and used in strict accordance with the requirements of the current legislation of Ukraine.

In case of disagreement with the provisions of this Policy, you have the right to refrain from providing personal data and use the functionality of the Site to the extent that does not require their processing.

2. Types of information that the Clinic may receive

2.1. The Clinic collects information concerning the Visitor only if he voluntarily provided the relevant information or expressly consented to its provision and/or use. The information that the Clinic collects includes:

Information that allows you to identify the visitor: The Clinic may collect and process information that allows you to directly or indirectly identify yourself as an individual (hereinafter referred to as “Personal Data”), in cases where you voluntarily provide such information during interaction with the Clinic through the Site. In particular, this occurs when filling out contact, registration or other forms, sending messages via the feedback form, making an appointment for a consultation or appointment, ordering and receiving medical or aesthetic cosmetology services, as well as when leaving reviews, comments, sending requests, applications or complaints through the Site or in another way using the Site’s functionality. Personal Data, in particular, includes: name and surname, telephone number, e-mail address, residential address, as well as other information that you voluntarily provide for the purpose of receiving services or communicating with the Clinic.
Secondary (technical) data: When you visit the Site, certain data is automatically recorded on the Clinic’s servers for system administration, as well as for statistical or backup purposes using a number of technologies, including, but not limited to, cookies, tags, IP address tracking/URL tracking and other tools. The recorded information may include the name of your Internet service provider, in some cases your IP address, data about the version of your browser software, the operating system of the computer from which you visited the Site, the addresses of websites that you visit simultaneously with our Site and, if possible, your search parameters that led you to the Site, date/time stamps, number of clicks, advertisements viewed and so on. You can block or disable cookies on your computer, which will limit the collection of Secondary Data through the use of cookies, but in this case you will not be able to use certain functional features of the Site and your user experience may be negatively affected.
The Clinic may also use other tracking services (third-party programs), such as Google Analytics, in order to understand and study the conditions of your use of our Site. Please note that in Google Analytics, information sent by your browser as part of the request for a web page, including cookies and your IP address, is collected. In this case, Google also receives this information, and its use is governed by the privacy policy of Google and/or the operator of the Google Analytics software; The Clinic is not a party to your relationship with third parties, such as operators of Google Analytics, etc.
Personal data of children: The Clinic does not wish to collect information about visitors who are under the age of 18. If parents or other legal representatives of a child discover that the child has provided certain information to the Site and believe that such data should be destroyed, upon their request, the Clinic will take steps to delete such information.

2.2. The Clinic uses cookies to ensure the functioning of the Site, improve usability, analyze traffic, personalize content and improve the quality of service provision. The use of optional cookies, analytical and marketing tools is not a condition for access to the Site and does not limit the User’s rights in the event of refusal to use them.

2.2.1. The site https://iyaclinic.com/ uses cookies and other tracking technologies to ensure its proper functioning, improve usability, analyze traffic and, with the User’s consent, for marketing purposes.

2.2.2. The Clinic uses the following categories of cookies:

1) Required (technical) cookies

These files are necessary for the functioning of the Site and to provide access to its basic features (including page navigation, correct operation of appointment forms, protection against unauthorized access).

Without the use of such cookies, the Site cannot function properly.

The use of required cookies does not require the User’s separate consent.

2) Analytical cookies

Used to collect general information about how Users interact with the Site (number of visits, traffic sources, pages viewed, etc.), which allows improving the structure, content and functionality of the Site.

Analytical cookies can be set, in particular, using web analytics services (for example, Google Analytics).

Such cookies are used exclusively with the User’s prior consent.

3) Marketing cookies

Used to personalize advertising messages, evaluate the effectiveness of advertising campaigns and display relevant advertising on other resources.

Marketing cookies are used exclusively with the User’s prior consent.

2.2.3. The User has the right at any time to change their settings regarding the use of optional cookies or to withdraw the consent provided through the appropriate cookie management tool on the Site or by changing their browser settings.

2.2.4. Refusal to use analytical or marketing cookies does not limit access to the Site, but may affect content personalization and usability.

3. Collection and use of personal data

3.1. Personal data that may be processed by the Clinic include:

Name, contact details (telephone, e-mail, address);
other data provided voluntarily and necessary to achieve the purposes of processing.

3.2. Personal data is collected by:

filling out forms on the Clinic’s website;
e-mail;
by telephone;
oral or written contact with the Clinic.

3.3. Personal data is used exclusively for:

implementation by the Clinic of its activities in providing aesthetic medicine and cosmetology services;
obtaining consultations/procedures specified on the Clinic’s website;
ensuring communication with Site Visitors;
fulfilling other obligations stipulated by the legislation of Ukraine.

3.4. Processing of medical (sensitive) personal data.

Within the framework of providing aesthetic medicine services, the Clinic may process a special category of personal data – data on health status, procedures performed, medical history, examination results and other medical information. Medical personal data are subject to medical confidentiality in accordance with the legislation of Ukraine.

Such data is processed exclusively:

with the patient’s written consent;
for the purpose of providing medical services;
for maintaining medical documentation in accordance with the requirements of the legislation of Ukraine in the field of healthcare.

4. Legal grounds for processing

4.1. The legal basis for processing personal data is:

the consent of the Subject of personal data;
the need to fulfill obligations stipulated by law;
the legitimate interests of the Clinic that do not violate the rights and freedoms of the Subject.

4.2. The processing of a special category of personal data (health data) is carried out in accordance with the requirements of the legislation of Ukraine in the field of personal data protection and health care, in particular on the basis of the patient’s written consent or in other cases stipulated by law.

4.3. The Clinic does not carry out automated decision-making, including profiling, which has legal consequences for the subject of personal data or significantly affects his rights and freedoms.

5. Conditions and terms of processing

5.1. Personal data is processed both with and without the use of automation tools.

5.2. The term of processing personal data is determined by the purpose of processing and/or the validity period of the Subject’s consent.

5.3. Personal data is stored by the Clinic for the period necessary to achieve the purposes of their processing, determined by this Privacy Policy, or for the periods established by the legislation of Ukraine, the terms of concluded contracts and warranty obligations.

5.4. Technical and analytical data are stored for the periods determined by the settings of the relevant services or until the User’s consent is withdrawn, but no longer than is necessary to achieve the purposes of the processing.

5.5. Personal data, the processing of which is carried out on the basis of the consent of the personal data subject, are stored until the withdrawal of such consent or until the achievement of the relevant purpose of the processing – depending on which comes first.

5.6. Personal data is deleted or depersonalized after the termination of the legal grounds for their processing and storage, provided that there is no obligation to further store them in accordance with the legislation of Ukraine or the need to store them to protect the rights and legitimate interests of the Clinic.

5.7. Medical documentation containing personal data of patients, including data on health status, examination results, procedures performed, recommendations and other information, is stored by the Clinic for the periods established by regulatory legal acts in the field of healthcare of Ukraine.

5.7.1. If the legislation provides for a mandatory period of storage of relevant medical documents, such personal data shall not be deleted before the expiration of the specified period, regardless of the withdrawal of the consent of the subject of personal data.

5.7.2. After the expiration of the established storage periods, medical documentation shall be destroyed or depersonalized in accordance with the procedure established by law.

6. Rights of personal data subjects

6.1. The subject of personal data has all the rights provided for by the Law of Ukraine “On Personal Data Protection”, other regulatory legal acts of Ukraine, as well as international treaties of Ukraine.

6.2. Within the framework of the Clinic’s activities in providing aesthetic medicine and cosmetology services, including cosmetic procedures, skin care, rejuvenation, using modern aesthetic medicine techniques, the subject of personal data has the right to:

6.2.1. know about the sources of collection of their personal data, their composition, location, purpose of processing (in particular, to receive consultations and services in aesthetic medicine and cosmetology), as well as about the owner of personal data;

6.2.2. receive information about the conditions for providing access to personal data, including about third parties to whom such data may be transferred (in particular, to the Clinic’s contractors, IT service providers, hosting providers, marketing and advertising partners, state bodies and state authorities – in cases provided for by law);

6.2.3. to access their personal data processed by the Clinic, as well as to receive a copy of such data in a form that does not violate the rights and legitimate interests of other persons;

6.2.4. to receive information about the fact of processing their personal data and their content no later than within thirty calendar days from the date of receipt of the relevant request;

6.2.5. to submit a reasoned request to object to the processing of their personal data, if such processing is not mandatory in accordance with the requirements of the law or the terms of concluded contracts;

6.2.6. to demand clarification, updating, correction or destruction of their personal data if they are inaccurate, outdated or processed in violation of the requirements of the law;

6.2.7. to withdraw consent to the processing of personal data at any time, if the processing is carried out on the basis of such consent, provided that the withdrawal of consent does not prevent the Clinic from fulfilling its obligations imposed on it by law or contract;

6.2.8. to demand restriction of the processing of their personal data in cases provided for by the legislation of Ukraine, in particular for the period of verification of the accuracy of the data or the lawfulness of their processing;

6.2.9. to protect their personal data from unlawful processing, loss, destruction, damage or unauthorized access, including when used in service, warranty and accounting documentation;

6.2.10. to file complaints regarding the processing of personal data with the Commissioner of the Verkhovna Rada of Ukraine for Human Rights or to the court;

6.2.11. to apply other legal remedies in case of violation of the legislation in the field of personal data protection.

6.3. To exercise his/her rights, the subject of personal data has the right to apply to the Clinic by submitting a written or electronic request using the contact details specified in this Privacy Policy.

6.4. The request of the subject of personal data must contain information that allows identifying the applicant, as well as a clear description of the requirement. The Clinic has the right to request additional information solely for the purpose of identifying the subject of personal data and protecting his/her rights.

6.5. The Clinic considers the requests of the subjects of personal data and provides a response within the terms specified by the legislation of Ukraine, but no later than within thirty calendar days from the date of receipt of the relevant request, unless another term is provided for by law.

6.6. The User may withdraw consent by sending a written or electronic message to the contact details specified in this Policy.

Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out prior to its withdrawal.

7. Transfer of personal data to third parties

7.1. The Clinic does not transfer personal data to third parties without grounds stipulated by the legislation of Ukraine. At the same time, for the proper execution of contracts and provision of services, the Clinic may transfer personal data to the following categories of recipients:

Hosting providers and IT partners – to ensure the operation of the site and data storage;
CRM systems and electronic document management systems – to process appointments, provide cosmetic services and maintain customer records;
Postal and call center services – to communicate with clients and notify about appointments for procedures;
Analytics systems (for example, Google Analytics) – to collect anonymized data on site traffic and improve the service.

7.2. When using analytics services (in particular, Google Analytics), cross-border transfer of personal data to other countries where the servers of the relevant service providers are located is possible.

Cross-border transfer of personal data is carried out subject to ensuring an appropriate level of protection of such data in accordance with the legislation of Ukraine and taking into account contractual guarantees provided by the providers of relevant services.

7.3. The Clinic transfers to third parties only those personal data that are necessary to perform a specific function or service. For example:

name, surname, contact phone number, email address, date of birth (if necessary), other data necessary for patient identification – for making an appointment and organizing the provision of medical services;
data necessary for the provision of the relevant medical service, including identification and medical data to the extent determined by law – for laboratory tests or consultations involving partners;
technical data (IP address, device type, operating system, cookie data, user activity logs) – for technical support, hosting and IT maintenance of the Site;
name, phone number, email address – for marketing and information mailings (with the consent of the User);
personal data to the extent provided for by the relevant request and the legislation of Ukraine – to fulfill the requirements of the law or at the request of authorized state bodies.

7.4. The Clinic ensures that all third parties to whom personal data is transferred are obliged to use them exclusively for the purposes specified by the Clinic and in accordance with the requirements of the legislation on personal data protection.

8. Personal data protection

8.1. The Clinic takes all necessary legal, organizational and technical measures to protect personal data from unauthorized access, modification, disclosure or destruction. However, no method of transmitting information via the Internet or mobile means of communication, or method of electronic storage is 100% secure. Accordingly, despite Our efforts, the Clinic cannot guarantee or ensure the security of any information that You transmit to Us using Our Site.

8.2. The User is aware that the transmission of information via the Internet is associated with certain risks, however, this does not exempt the Clinic from the obligation to take measures to protect personal data provided for by law.

8.3. In the event of a breach of personal data security, the Clinic takes the necessary measures to minimize the risks and, in cases provided for by law, notifies the subjects of personal data and authorized bodies.

8.4. The Clinic applies organizational, technical and physical measures to protect personal data, including access restrictions, the use of anti-virus software and control of access to medical documentation.

8.5. None of the provisions of this section limits the liability of the Clinic in cases where such liability is provided for by mandatory provisions of the legislation of Ukraine.

9. Changes to the Privacy Policy

9.1. This Policy may be changed or supplemented unilaterally. All changes are published on the official website of the Clinic and come into force from the moment of publication.