Privacy Policy

1.1. Personal data - information or a set of information about a natural person who is identified or can be specifically identified.

1.2. Sensitive personal data — personal data related to the state of health, psycho-emotional state, disability, as well as other data that require a higher level of protection by law.

1.3. Processing of personal data is any action or set of actions, such as collection, registration, accumulation, storage, adaptation, change, renewal, use and distribution (distribution, implementation, transfer), depersonalization, destruction of personal data, including using information (automated) systems.

1.4. The owner of personal data — the organization that determines the purpose of processing personal data, establishes the composition of this data and the procedures for its processing.

1.5. The manager of personal data is a natural or legal person to whom the Owner transfers personal data on the basis of a contract for their processing in accordance with the specified purpose.

1.6. The CRM system is an information system for managing interaction with users (in particular, Creatio), which is used by the Organization for the administration of appeals, registrations, coordination of psychologists' activities, etc.

1.7. The mobile application is the Self-Help App software, which is administered by the Organization and provides psycho-emotional support services, self-help and communication with consultants.

1.8. The site is the website of the Organization www.uamentalhelp.clinic.

2.1. This Policy defines the conditions, procedure and legal grounds for the Organization's processing of personal and sensitive personal data provided by Users in connection with:

• registration in the Self-Help App mobile application or on the website;
• filling out forms, questionnaires, tests (including GAD-7, PHQ-9);
• participation in online or offline consultations;
• applying for help to the Organization or interacting with the Organization's specialists;
• transfer of information of a technical or administrative nature.

2.2. The policy applies to all information that may be collected by the Organization during the use of digital services, regardless of which devices the User accesses.

2.3. This Policy is a public offer for the User and an integral part of the terms of use of the mobile application, website and related services.

2.4. Digital services of the Organization are intended exclusively for persons who have reached the age of 18. Registration and use of the service by minors without the permission of a legal representative is prohibited.

3.1. Processing of personal data is carried out exclusively for the purpose of:

• provision of psychological assistance, psycho-emotional support, individual or group consultations (legal basis: Article 6(1)(a) GDPR — consent; regarding sensitive data — Article 9(2)(a) GDPR — explicit consent);
• organization, administration and documentation of the consultation process (legal basis: Article 6(1)(b) GDPR — necessary to fulfill obligations to the User);
• conducting supervisions, internal analysis of the quality of the services provided (only in depersonalized form) (legal basis: Article 6(1)(f) GDPR — legitimate interest of the Organization);
• ensuring the exchange of information between the User and the Organization's specialists (legal basis: Article 6(1)(a), (b) GDPR — consent and/or contractual necessity);
• implementation of the legitimate interests of the Organization, in particular regarding compliance with the requirements of current legislation in the field of personal data protection (legal basis: Article 6(1)(c) and 6(1)(f) GDPR — legal obligation and/or legitimate interest).

4.1. Within the scope of the purpose of processing defined by this Policy, the Organization processes personal data of Users received directly from the subject of personal data, or in the process of using the Self-Help App mobile application, the Organization's website, other digital services, as well as during personal or remote participation in psychological counseling.

4.2. Personal data that may be processed by the Organization includes:

• Identification data, which allow to establish the User's identity, in particular, surname, first name, patronymic (in case of voluntary provision), date of birth, gender, as well as a unique system identifier created within technical accounting;
• Contact details, necessary to communicate with the User, including phone number, email address, as well as other methods of communication that the User can specify during registration or in the process of receiving services (for example, accounts in messengers or profiles in the application);
• Socio-demographic information, which is provided by the User voluntarily or as part of screening questionnaires, in particular age, region of residence, type of employment, social status;
• Information related to the psycho-emotional state of the User, obtained as a result of completing standardized primary assessment tools (including, but not limited to, GAD-7, PHQ-9), as well as other responses to questions on screening forms, questionnaires, or self-reported statements containing information about emotional, mental, or behavioral status;
• Information provided by the User during psychological consultations, including the content of requests, personal experiences, descriptions of life situations, which, depending on the context, may directly or indirectly contain sensitive personal data;
• Sensitive personal data, which relate to the User's state of health, including mental health, obtained within the scope of providing psychological assistance. Such data include: information about complaints, psycho-emotional characteristics, previous experience of psychotherapy or psychiatric intervention, as well as any information that, according to the law, can be considered medical or medical confidentiality. The collection and processing of such data is carried out exclusively in the presence of the clear, informed and voluntary consent of the subject of personal data, with the observance of special security guarantees;
• Technical information, which is generated in the process of interaction with the digital services of the Organization, including data about the User's device, IP address, time and date of sessions, interface language, information about the version of the application, type of operating system, browser, technical access logs, as well as other information that is automatically recorded to ensure the functioning of the service, data protection, and improve the quality of the services provided.

4.2.8. The processing of the above categories of personal data is carried out only to the extent necessary to achieve the goals defined by this Policy. In the event of a change in the purposes of processing, the Organization undertakes to obtain a new informed consent from the User in advance.

5.1. Before starting the processing of personal data, the Organization ensures obtaining the proper, freely given, specific, informed and unambiguous consent of the User for such processing in accordance with Art. 7 GDPR and the Law of Ukraine "On Personal Data Protection".

5.2. In the framework of electronic interaction, the User's consent is considered given if he has taken a clear affirmative action, in particular (but not exclusively):

• set a mark (checkbox) in the electronic form of the website or mobile application;
• clicked the button "Send", "Confirm", "I agree", etc.;
• sent an electronic application/message/form with your personal data;
• passed technical verification (identification by ID code, token or other unique parameter);
• confirmed reading this Policy and accepted the User Agreement.

5.3. The fact of giving consent is recorded using the CRM system or other software of the Organization, which provides:

• saving the date and time of giving consent;
• user ID fixation;
• saving the IP address, device and type of interaction;
• recording of the consent mechanism (checkbox, button click, email, etc.).

5.4. All data related to the provision of consent are stored for the period specified in this Policy and can be used as proof of the proper informing of the User about the purpose and scope of processing.

5.5. Processing of sensitive personal data (in particular, about health, psycho-emotional state) is carried out exclusively on the basis of separately provided, explicitly expressed consent, in accordance with Article 9 of the GDPR and Article 7 of the Law of Ukraine "On the Protection of Personal Data".

5.6. The user has the right to:

• refuse to give consent before processing begins;
• withdraw previously given consent at any time by sending an appropriate message:
• by e-mail to the official address of the Organization;
• through the Personal account or the corresponding online form;
• or in writing (in the case of offline interaction).

5.7. In case of withdrawal of consent:

• the record in the CRM or other system is updated with the date and time of recall;
• processing of personal data is stopped (except in cases provided by law);
• The user may be limited in access to services that require the processing of such data (for example, psychological consultations), about which he will be informed in advance.

6.1. Processing of users' personal data is carried out by the Organization in compliance with the principles of legality, good faith, transparency, proportionality and data minimization.

6.2. Personal data is processed both with the use of automated means and without them, by performing one or more actions, including: collection, registration, systematization, accumulation, storage, clarification (updating, changing), use, depersonalization, blocking, deletion and destruction.

6.3. Data processing is carried out using digital platforms, including, but not limited to, the Self-Help App mobile application, the Organization's website, internal electronic document management tools, as well as the Creatio CRM system, which is used for organizational administration, technical support, record-keeping of requests, communication with consultants and coordination of sessions.

6.4. The period of storage of personal data of Users does not exceed 36 (thirty-six) months from the date of the last interaction of the User with the Organization, except for cases when a longer period is due to the need:

• fulfillment of obligations to state bodies in accordance with the requirements of legislation;
• ensuring the protection of the legitimate interests of the Organization in connection with possible claims, appeals or legal disputes;
• separate written consent of the User for continued storage.

6.5. After the end of the storage period specified in Clause 5.4 of this Policy, personal data shall be destroyed or depersonalized, unless otherwise provided by the mandatory legislation of Ukraine or the European Union.

6.6. The organization does not process personal data for the purpose of making automated decisions that have legal consequences for the User, including profiling, without prior notification and separate consent.

6.7. The organization takes all reasonable measures to ensure the relevance and authenticity of processed personal data, as well as timely updating of such information in accordance with the requests of Users.

7.1. The organization may transfer users' personal data to third parties only in the cases stipulated by this Policy, the terms of the User's consent, the current legislation of Ukraine and/or the provisions of the GDPR and only within the scope of achieving the purpose of processing such data.

7.2. Personal data may be transferred to the following categories of third parties:

• Data Processors — to legal entities or individuals who process personal data on behalf of the Organization and solely on the basis of the relevant agreement on the processing of personal data. In particular, this applies to providers of CRM systems (in particular, Creatio), cloud services, testing tools, electronic communication services, etc. All such processors are obliged to ensure a sufficient level of data protection and act exclusively according to the instructions of the Organization.
• To consultants, psychologists, supervisors — only within the limits of the information necessary to provide the User with psychological help and support, and subject to compliance with the principles of professional ethics and confidentiality.
• State authorities — exclusively on the basis of legal requirements, court decisions or in situations where there is a potential threat to the life, health or safety of the User or other persons.

7.3. The transfer of personal data abroad, including to countries that are not members of the European Union or the European Economic Area, may be carried out only in the case of:

• compliance with the requirements of Articles 29–32 of the Law of Ukraine "On the Protection of Personal Data";
• ensuring the appropriate level of protection of personal data in the country of destination;
• the presence of a separate informed consent of the User (if required by law).

7.4. The organization does not transfer personal data for the purposes of direct marketing or commercial gain of third parties.

7.5. All third parties to whom personal data may be transferred are obliged to comply with the provisions of this Policy and to provide adequate organizational and technical guarantees for the security of such data.

8.1. The organization recognizes the protection of personal and sensitive personal data as one of its key responsibilities and takes all necessary legal, organizational and technical measures to ensure their confidentiality, integrity and availability in accordance with the requirements of the Law of Ukraine "On the Protection of Personal Data", the General Data Protection Regulation (GDPR), as well as other acts that regulate this area.

8.2. In order to protect personal data, we implement a set of measures, including, in particular:

• Organizational activities: appointment of a responsible person (or structural unit) for compliance with requirements in the field of personal data protection; conducting regular training for employees and consultants on confidential handling of personal data; providing access to personal data only to those persons for whom it is necessary for the performance of professional duties; conclusion of confidentiality agreements with all persons involved in the processing of personal data.
• Technical measures: use of certified software and secure communication channels (including HTTPS, SSL/TLS); restricting access to information systems containing personal data using multi-factor authentication; regular software updates, antivirus protection and monitoring of unauthorized access attempts; data backup and storage in a secure environment; audit of information systems for security and compliance with policy requirements.
• Procedural measures: keeping an internal log of personal data processing; regular review and updating of internal documentation on personal data protection; procedures for responding to security incidents and reporting to relevant government bodies and subjects of personal data in the event of a leak or breach of data integrity.

8.3. We undertake to immediately inform the subjects of personal data in case of detection of a security breach that may lead to risks for their rights and freedoms, and, if necessary, to notify the Commissioner of the Verkhovna Rada of Ukraine for human rights or the supervisory authority in the jurisdiction of the subject.

8.4. The organization is constantly improving its personal data protection system, taking into account technological development, best practices and changes in legislation.

9.1. All subjects of personal data, whose personal or sensitive personal data are processed by the Organization, have legal rights, the implementation of which is guaranteed in accordance with the requirements of the Law of Ukraine "On the Protection of Personal Data" and the General Data Protection Regulation (GDPR).

9.2. In particular, the subject of personal data has the right to:

• Know about the sources of collection, the location of your personal data, the purpose of their processing, the location or place of residence (residence) of the Owner or Manager of personal data, or give the appropriate mandate to receive this information to persons authorized by him, except for cases provided by law.
• Receive information about the conditions for providing access to personal data, in particular information about third parties to whom personal data is transferred.
• Get access to your personal data and the content of such data no later than thirty calendar days from the date of receipt of the corresponding request, except for cases provided by law.
• Submit a reasoned claim with an objection to the processing of your personal data, if such processing is unlawful or does not correspond to the declared purpose.
• Request the modification or destruction of your personal data if such data is processed illegally or is unreliable.
• Familiarize yourself with the mechanisms of automatic processing of personal data, if such occurs.
• Appeal the processing of personal data to the Commissioner of the Verkhovna Rada of Ukraine for human rights or to the court.
• Withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
• To apply the methods provided by law to protect one's rights, in case of violation of the order of processing or protection of personal data.
• The subject of personal data has the right to withdraw the consent given by him at any time by sending a message by e-mail, through the functionality of the Personal Cabinet or in writing. The organization shall stop processing the subject's personal data as soon as possible, but no later than within 5 working days from the date of receipt of the notification.

9.3. If the User is in the territory of the European Union, he has additional rights, in particular:

• The right to limit the processing of personal data;
• The right to data portability;
• The right to object to the processing of personal data, including direct marketing;
• The right not to be subject to an automated decision that has legal consequences or significantly affects the User;
• The right to file a complaint with a supervisory authority in the relevant jurisdiction.

9.4. Implementation of the rights of the subject of personal data:

• To exercise his rights, the subject may contact the Organization by submitting a written or electronic request to the contact details specified in this Policy.
• In order to properly process the request and prevent fraud, the Organization has the right to request confirmation of the applicant's identity.
• The organization undertakes to provide an answer within 30 calendar days from the moment of receiving the appeal.
• If the request is clearly unreasonable or excessive, the Organization reserves the right to demand a reasonable fee or refuse to satisfy the request.

10.1. The organization has the right to transfer personal and sensitive personal data to third parties only in cases provided for by the current legislation of Ukraine, in particular the Law of Ukraine "On the Protection of Personal Data", as well as, if necessary, in accordance with the requirements of the GDPR.

10.2. The transfer of personal data to third parties may be carried out exclusively within the defined purpose of processing and provided that such persons ensure an adequate level of protection of personal data, no lower than that established by this Policy and legislation.

10.3. In particular, personal data of Users may be transferred to the following categories of third parties:

• Managers of personal data — entities with which the Organization has concluded relevant contracts (in particular, the Organization uses CRM Creatio to process and administer requests).
• Consultants, psychologists, specialists of the Organization — in the amount necessary for the provision of services.
• State authorities, law enforcement or control bodies — exclusively in cases directly provided for by law.
• Partners or donor organizations — exclusively in depersonalized (anonymized) form.

10.4. All third parties to whom personal data is transferred undertake to use it exclusively for the specified purpose, not to disclose it without the User's consent, and to ensure an appropriate level of technical and organizational protection.

10.5. The organization does not sell, rent, exchange or other commercial transfer of personal data to third parties without the separate consent of the User.

10.6. Data may be transferred outside of Ukraine if there are legal grounds provided for by the Law of Ukraine "On the Protection of Personal Data" or relevant international acts, in particular GDPR. In case of data transfer to countries outside the European Economic Area (EEA), such transfer is carried out in accordance with Articles 44-49 of the GDPR.

11.1. The organization takes all necessary legal, organizational and technical measures to ensure the appropriate level of security of personal and sensitive personal data processed in accordance with the requirements of the Law of Ukraine "On the Protection of Personal Data", GDPR, as well as other applicable legal acts.

11.2. The system of protection of personal data in the Organization is built on the principles of legality, proportionality, minimization of processing, restriction of access and responsibility of persons involved in data processing.

11.3. In order to prevent unauthorized access to personal data or their loss, unlawful destruction, forgery, damage, blocking, disclosure or distribution, the Organization implements the following security measures: use of modern encryption technologies, firewalls, intrusion detection systems, antivirus protection; placement of personal data on secure servers with multi-level access control; regular data backup; provision of physical protection of premises; restricting access to personal data exclusively for authorized employees; keeping an internal log of personal data processing; regular training of employees.

11.4. The organization is responsible for compliance with the requirements established by law regarding the processing and protection of personal data and ensures the functioning of the responsible person or structural unit for the protection of personal data.

11.5. In the event of a breach of confidentiality or an incident related to the security of personal data, the Organization acts in accordance with internal response procedures, which include: detection, documentation and analysis of the nature of the incident; risk assessment for the rights and freedoms of individuals in accordance with Article 33 of the GDPR — in case of high risk, the Organization notifies the competent supervisory authority no later than 72 hours from the moment the incident is detected; informing the subject of personal data about the nature of the incident; documenting the incident in the internal register of personal data protection violations (Data Breach Log); carrying out a personal data protection impact assessment (DPIA) if necessary; taking measures to eliminate the consequences of the incident and prevent similar incidents in the future.

12.1. To ensure proper operation of the website and/or mobile application, as well as to improve interaction with the User, the Organization may use cookies and other similar tracking technologies that collect technical information about the User.

12.2. Such technologies may include:

• Cookies — small text files stored in the User's browser when accessing the site;
• SDK trackers — embedded software elements integrated into the mobile application (for example, Firebase, AppMetrica);
• Device ID — unique identifiers of the device (for example, GAID, IDFA);
• Web beacons / pixels — invisible graphic objects that allow tracking of the User's actions.

12.3. The organization can use the following types of cookies and trackers:

• Functional — to save user settings;
• Analytical — to collect statistical information (in particular, Google Analytics, Firebase);
• Marketing — to personalize advertising messages (used only with the User's consent);
• System (required) — without which full-fledged operation of the platform is technically impossible.

12.4. Analytical and marketing tracking technologies are used only with the prior consent of the User, which is provided through the appropriate banner, pop-up window or other technical means.

12.5. The user has the right to: refuse to use tracking technologies (except for necessary ones); configure access to cookies through the settings of your browser or device; manage permissions within the functionality of the application.

12.6. All information collected with the help of tracking technologies is not used for direct identification of a person, unless the User provides it himself.

13.1. The organization reserves the right to periodically change or update this Policy in accordance with changes in legislation, personal data protection practices, partner requirements or internal procedures.

13.2. In the event of significant changes to the terms of personal data processing, the Organization undertakes to notify Users of such changes by publishing a new version of the Policy on the official website www.uamentalhelp.org, as well as, if possible, by notification by e-mail or through the functionality of the mobile application.

13.3. The user is advised to periodically review the Policy to familiarize himself with the current conditions. Continued use of the Organization's digital services after the publication of changes to the Policy will be considered acceptance of such changes.

14.1. For all issues related to this Policy, processing, storage, correction or deletion of personal data, the User can contact the Organization at the following contacts:

• Full name: "YUA MENTAL HELP MENTAL HEALTH CENTER" LIMITED LIABILITY COMPANY
• Abbreviated name: LLC "CENTER OF MENTAL HEALTH UAMH"
• Name in English: LIMITED LIABILITY COMPANY «MENTAL HEALTH CENTER UA MENTAL HELP»
• EDRPOU code: 45341299
• Legal address: 04116, Ukraine, Kyiv, st. Havrylyshyn Bohdana, bldg. 24, office 8
• E-mail: support@uamentalhelp.org
• Phone: +380443343107
• Website: https://uamentalhelp.clinic

14.2. The appeal can be submitted in written or electronic form. The Organization may request additional information to identify the User.

14.3. The organization undertakes to respond to appeals, requests or demands of the subjects of personal data within the terms established by the current legislation.