Personal data processing policy
Version of 15 October 2026.
General provisions
This policy explains how the Quintessence clinic processes the personal data of visitors to the quintessence.kz site and its subdomains. It applies to the clinic pages and to the rehabilitation centre pages.
The policy follows the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection” (the Law).
The policy applies only to the site. Health data that the clinic receives during an appointment is protected as medical confidentiality under the Code of the Republic of Kazakhstan “On Public Health and the Healthcare System”. Its processing is governed by healthcare legislation and the clinic’s internal documents.
Who processes the data
The owner and operator of the personal data database is AK QUINTESSENCE LLP, BIN 220340000828. Legal address: 050059, Almaty, Medeu District, 21 Iskenderov St, non-residential premises 71.
Clinic address: 21 Iskenderov St, Almaty. Email: info@quintessence.kz. Front desk phone numbers: +7 708 110 02 36, +7 727 346 85 25.
What data we receive
Through the booking form:
- your name;
- your phone number;
- the service that you select;
- the location: the clinic or the rehabilitation centre;
- the doctor, if you select one;
- the preferred appointment date, if you give one;
- the language of the page from which you send the request;
- the visit source, if you came from an ad or a tagged link: UTM tags, gclid, yclid, fbclid;
- the date, time and version of the consent text.
Automatically, when you open the site:
- IP address, browser type and device type;
- the addresses of the pages that you open and the time of the visit;
- cookies and tracker identifiers; see “Cookies and trackers” below.
The form does not ask for health data. Do not write diagnoses or test results in the form. Discuss them with the doctor during the appointment.
If you book an appointment for another person, for example a child, you confirm that you have the right to give their data.
Why we process the data
- to book your appointment and to call you to confirm it;
- to prove that you gave consent to data processing;
- to see how visitors use the site and to make the site better;
- to measure the effectiveness of the clinic’s advertising.
We do not use the form data for mailings without your separate consent.
Legal basis for processing
We process the form data with your consent. You give consent when you tick the consent box and send the form. The form does not send a request without consent.
Your consent includes the transfer of the request data to amoCRM outside the Republic of Kazakhstan; see “Who receives the data” below.
We keep the date, time and version of the consent text. We use them to prove your consent when necessary.
Where and how we keep the data
We keep the form data in the site database on a server of Company Hoster.KZ LLP (hoster.kz) in the Republic of Kazakhstan. This database is the main storage of the requests.
Only the staff who book patients and the site administrator have access to the requests.
The connection to the site uses HTTPS encryption. A password protects the database. Each staff member sees only the data that they need for their work.
If a data leak occurs, the clinic tells the authorised body about it in the procedure that the Law specifies.
Who receives the data
- amoCRM (amocrm.ru), the system in which the administrators of the clinic and of the rehabilitation centre manage appointments;
- Company Hoster.KZ LLP, the hosting provider of the site server;
- state bodies, only in the cases that the law directly specifies.
The amoCRM servers are in the Russian Federation. Thus, the transfer of a request to amoCRM is a cross-border transfer of personal data. amoCRM receives only the request data: name, phone, location, service, item from the price list, doctor, preferred date, the address of the page that you sent the request from, the language of the page, and the utm_source and utm_campaign parameters as deal tags. The main copy of the request stays on the server in the Republic of Kazakhstan.
We do not sell data. The name and phone from the form do not go to advertising systems. The trackers receive only the fact that you sent a request and its location (the clinic or the rehabilitation centre), without the rest of its content.
Cookies and trackers
Cookies are small files that the site keeps in your browser. The site uses these analytics, advertising and map services:
- Yandex Metrica, for visit statistics. Its Webvisor module records your actions on the page: scrolling, clicks and cursor movement. The booking form fields are excluded from Webvisor recording;
- Google Analytics, for visit statistics;
- the Meta pixel, to measure advertising in Facebook and Instagram;
- Yandex Maps, for the map on the clinic and centre pages. The map image, and the interactive map that opens with the “Show map” button, load from Yandex servers, so Yandex receives your IP address.
These services receive visit data: cookie identifier, IP address, device type and opened pages. They keep this data on their servers, also outside the Republic of Kazakhstan.
You can block cookies in the browser settings or install a tracker blocker. The site and the booking form continue to work.
How long we keep the data
We keep the request and the consent data on the site server for 12 months from the date that you send them. Then the site deletes them automatically. We delete the copy of the request in amoCRM at your request or under the data retention rules in amoCRM.
Backup copies of the site database, with the requests, are kept for 30 days on a service server of the clinic at the same provider in the Republic of Kazakhstan. Then they are deleted automatically.
If you become a patient of the clinic, your data goes into the medical records. The healthcare legislation sets the storage period of these records.
Your rights
Under the Law, you have the right:
- to know if the clinic has your data, and to get information about it: the purpose, method and period of processing;
- to ask the clinic to correct or complete the data;
- to ask the clinic to block or destroy the data if it was collected or processed in violation of the Law;
- to withdraw your consent to processing, except in the cases that the Law specifies;
- to protect your rights through the authorised body for personal data protection or in court.
How to withdraw consent or send an inquiry
Write to info@quintessence.kz, or give a written application to the front desk at 21 Iskenderov St, Almaty. Give the name and phone that you left on the site.
We reply in the period that the Law specifies.
After you withdraw consent, we stop the processing and delete the data, except the data that the law tells us to keep. The withdrawal does not cancel the processing that occurred before it.
Changes to the policy
The clinic can change this policy. A new version is valid from the time that it appears on this page. The version date is at the top of the page.