Contents
This Privacy Policy (the "Policy") describes how — (—, TIN —, address: —; the "Operator") processes the personal data of users of the MedIQ platform (https://mediq.uz; the "Platform").
The Policy follows the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547 of 2 July 2019) and other applicable legislation. By using the Platform you agree to the terms of this Policy.
Current version: 1.0, in force from 16 October 2026.
1. General
1.1. The Policy applies to every section of the Platform, to the registration and contact forms, and to the messages the Operator sends.
1.2. Personal data is any information relating to an identified or identifiable natural person. Processing is any operation on such data: collection, storage, alteration, use, transfer and destruction.
1.3. The Operator, as the owner and operator of the personal data database, determines the purposes and means of processing.
1.4. Some features (for example creating an account or paying) do not work without certain data. If you do not agree with the Policy, do not use the Platform.
2. What data is collected
| Category | Examples | Source |
|---|---|---|
| Account data | name, e-mail, username, password (hashed only), role (student, resident, doctor, clinic, expert), interface language | entered by you |
| Learning profile | university, stage, programme, year of study — optional | entered by you |
| Learning activity | completed lessons, case attempts and answers, test results, OSCE attempts, XP and level, streaks, Arena results, certificates | automatically as you use the Platform |
| AI interactions | the text you enter into the virtual patient, the AI mentor and the evidence-based-medicine tools, and the answers given | entered by you |
| Payments | order number, plan or course, amount, status, payment service (Payme, Click), time. Bank card data is processed only by the payment service | at payment |
| Enquiries | name, e-mail, topic and message from the contact form, the page the form was sent from, a hash of the IP address | entered by you |
| Content you post | university reviews and comments, course reviews, public profile, job applications and cover letters | entered by you |
| Technical data | IP address, device and browser type, cookies, pages visited, error logs | automatically |
The Operator does not knowingly collect special categories of data (health status, religious beliefs and the like). Do not enter data into the AI features that could identify real patients.
3. Purposes and legal bases
| Purpose | Data | Basis |
|---|---|---|
| Creating the account, providing the Platform's services, running the learning process | account, learning profile and activity, AI interactions | performance of the agreement (public offer) |
| Taking payments, keeping records of orders and subscriptions | payment data | performance of the agreement, legal requirements |
| Security, preventing fraud and abuse | technical data, account data | the Operator's legitimate interest |
| Answering enquiries, service messages | enquiries, e-mail | your consent, performance of the agreement |
| Improving the Platform, statistics and analytics | technical data, de-identified usage data | your consent |
| Meeting legal requirements | accounting and payment documents | legal requirements |
Marketing messages are sent only with your prior consent, and every one of them offers a way to unsubscribe.
4. Cookies and analytics
4.1. Cookies required for the Platform to work:
| Name | Purpose | Lifetime |
|---|---|---|
| mediq_session | keeping you signed in | session or until sign-out |
| MEDIQ_LOCALE | the chosen interface language | 1 year |
| sidebar_state | state of the app menu | 7 days |
| theme (browser storage) | light or dark theme | until cleared |
4.2. Analytics. For usage statistics the Operator may enable Google Tag Manager and Google Analytics (Google LLC) and Yandex Metrica (Yandex). Through cookies (such as _ga, _ym_uid) they collect aggregated information about pages visited, device and browser, approximate region and actions on the Platform. The Operator does not pass your name, e-mail or other direct identifiers to analytics; only language, role and plan type are used for segmentation.
4.3. You can disable analytics cookies in your browser settings or with the providers' tools (Google Analytics Opt-out, the Yandex Metrica blocker). Without the required cookies the Platform will not work correctly.
5. Who receives the data
5.1. The Operator does not sell personal data. Data is shared only in the following cases and only to the extent necessary:
- Hosting and infrastructure — —: storing data and running the Platform.
- Payment services — Payme and Click: taking payments. They are independent operators of payment data.
- AI provider — Google LLC (Gemini API): the text you enter into the AI features is processed to generate an answer. When AI is not connected, the Platform works offline and transfers no data.
- Analytics — Google (Tag Manager, Analytics) and Yandex (Metrica), as described in section 4.
- E-mail delivery service — for service e-mails and notifications.
- Experts — the author of a course sees that you are enrolled, your questions and your reviews.
- Clinics — when you apply for a vacancy, your application, profile and letter are provided to that Clinic.
- Public visibility — the certificate verification page shows the holder's name, the course title and the date; the public profile (https://mediq.uz/u/username) is visible until you disable it in the settings; university reviews are shown anonymously by default.
- State bodies — only in the cases and the manner set by law.
5.2. AI and analytics providers may process data outside the Republic of Uzbekistan. By using those features you consent to such cross-border transfer; the Operator ensures the providers' contractual data-protection obligations.
6. Storage location and retention
6.1. Users' personal data is stored on the servers of —.
6.2. Retention periods:
| Data | Period |
|---|---|
| Account, profile and learning activity | while the account exists; deleted immediately when the account is deleted, backups may keep it for up to 90 days |
| Payment documents and orders | for the period set by accounting and tax legislation |
| Contact-form enquiries | up to 24 months |
| Technical logs | up to 12 months |
| Analytics data | according to the providers' policies |
7. Security
The Operator protects data with the following measures: all connections are encrypted (HTTPS/TLS); passwords are stored only as hashes; access to data is restricted by role and granted only to staff who need it for their work; backups are made regularly; security events are monitored. If a personal data breach is discovered, the Operator notifies the affected persons and the competent authority as required by law.
8. Your rights
Under the law you have the right to:
- be informed about the processing of your data and request a copy of it;
- correct inaccurate data — in the profile settings or on request;
- delete your data — the "Delete account" function in the profile settings permanently deletes the profile, results, certificates, orders and subscription;
- withdraw consent, object to processing or request that it be restricted;
- lodge a complaint with the competent state body.
Requests are sent to — or — and handled within the period set by law and no later than 10 working days. Additional information may be requested to confirm your identity.
9. Children
The Platform is not intended for persons under 16. Users aged 16 to 18 register with the consent of a parent or legal representative. If it turns out that data of a child under 16 was collected without consent, the Operator deletes it.
10. External links
The Platform may link to other websites (sources, providers, universities). The Operator is not responsible for their content or privacy practices.
11. Changes to the Policy
The Operator may update the Policy. A new version is published at https://mediq.uz/legal/privacy with its version number and effective date. Changes that materially affect your rights are announced in advance on the Platform or by e-mail.
12. Contact
| Item | Value |
|---|---|
| Operator | — |
| Address | — |
| Personal data officer | — |
| — | |
| Phone | — |
See also:Public offer