Privacy policy and protection of medical documents

1. Who processes your data

The controller of your personal data is Solidaroba, address 116 David Aghmashenebeli Avenue, Tbilisi, which operates the website solidaroba.ge (hereinafter "we"). The contact e-mail for data protection matters is info@solidaroba.ge.

We act in accordance with the Law of Georgia "On Personal Data Protection". Under this law, information about a person's health is special category data, and we process it with enhanced protection.

2. What data we collect

Only what is needed for the service you request:

• Contact details: the name, phone number, e-mail address and preferred channel of communication that you enter in the form.
• Description of your request: information you give us in free text, which may concern your health.
• Uploaded files: Form 100, discharge summaries, test and imaging results, prescriptions, ID card, civil status documents, a draft will and other documents needed for the service. As a rule, these files contain special category data.
• Technical data: server logs (IP address, time and address of the request, browser type), which are recorded automatically for security and troubleshooting and deleted within 30 days.

We do not collect data you have not given us, and we do not obtain information about you from third parties without your consent.

3. For what purpose and on what basis

We do not use the data to send marketing messages, for profiling or for automated decision-making, and we never sell it.

4. How we protect files

Uploaded medical and legal documents are the most sensitive data we process. For them we follow five technical and organisational rules:

1. Encrypted transfer. Files received through the form or by e-mail reach the server only over an encrypted (TLS) connection. The site does not load over an unencrypted connection.
2. Storage outside the web root. Files are stored in a part of the server that cannot be reached through a web address. There is no link to a file, and it cannot be guessed.
3. Encrypted storage. Files and their backups are stored encrypted on disk, and the keys are kept separately from the files.
4. Access only for the person doing the work. A file can be seen only by the staff member or partner specialist working on your case, with personal authentication. Every access is logged.
5. Duty of confidentiality. Every staff member and partner (translator, lawyer, coordinator) has signed a confidentiality agreement that remains in force after the contract ends.

No system can fully guarantee information security. In the event of a security incident affecting your data, we will notify both you and the State Audit Office within the time limit set by law.

5. How long we keep data

• Files without an order: if you do not order a service after the price estimate, the uploaded files are deleted automatically within 30 days, or sooner as soon as you ask.
• Files after an order: originals, translations and documents produced during the service are deleted 30 days after the service is completed. This period is needed for any corrections and for handing over a document again.
• Longer storage at your choice: if you use the digital archive service, the files are kept until you delete them yourself or close the archive.
• Contact and financial data: invoices and payment records are kept for the period set by tax legislation, without any medical content.
• In the event of a dispute: data may be retained until the dispute is resolved, only to the extent needed to protect our rights or yours.

Deletion means that the file is irreversibly removed from the main storage and that its copies drop out of the backup cycle within 30 days at the latest.

6. Who we share data with

We pass your documents only to those who need them to perform the service you requested, and only to the extent needed for that specific task:

• Partner specialists: Advocat.Ge lawyers and translators of the translation bureau, who perform the service and are bound by the same confidentiality rules.
• A notary: when a translation is certified or a power of attorney or will is executed, in the manner laid down by law.
• State bodies: the Public Service Hall, embassies, the regulatory agency, the ministry or City Hall, when we submit an application or a document on your behalf.
• Clinics, banks, carriers: only with your prior and explicit consent, to a specific organisation named in advance. For clinics abroad this means transferring data to another country; we agree this with you separately each time.
• Technical providers: hosting and e-mail service providers, which process data on our instructions under a contract and have no access to it for any other purpose.

We do not sell or rent out data, and we do not share it with anyone for advertising. We pass data to a public body only on the basis of a mandatory request provided for by law and, unless the law prohibits it, we will inform you.

7. Cookies and third-party services

The site does not use tracking cookies and does not run visitor behaviour analytics by default. Technical information needed for the site to work (for example, whether a menu is open) stays in your browser and never reaches us.

The site's font is loaded from Google Fonts servers. When this happens, your browser sends your IP address to Google, which processes it under its own privacy policy. If we add analytics or another third-party tool in the future, we will update this document and, where the law requires it, ask for your consent in advance.

8. Your rights

Under the law, you may at any time request:

• Information and access: what data we process about you, for what purpose and to whom we have passed it, as well as a copy of that data.
• Rectification: correction of inaccurate or incomplete data.
• Erasure: deletion of data and files, which we confirm within 3 working days, except for data that the law requires us to keep.
• Restriction or cessation of processing: including withdrawal of consent at any time. Withdrawal does not affect processing lawfully carried out before it, but it may make it impossible to continue the service.
• Portability: receiving the data you provided in a structured, commonly used format.
• Complaint: lodging a complaint with the State Audit Office of Georgia or a court if you believe your rights have been violated.

We respond to requests free of charge within the time limit set by law. To confirm your identity, we may ask you for additional information so that we do not pass data to someone else.

9. Minors and representatives

We process the data of a minor patient only at the request and with the consent of a parent or legal representative. If a family member sends a request on the patient's behalf, we assume that they have the patient's consent or legal authority, and where necessary we ask for proof of this (a power of attorney, a guardianship document) before passing documents to a third party.

10. Changes and contact

We update this policy when the law or our processes change. A new version takes effect from the publication date shown at the top of the document. We inform clients whose cases are in progress of any material change by e-mail or phone.

For any question, request or complaint about data protection, contact us through the contact page or at the e-mail address given in section 1. The status of medical information and our role in medical decisions are described in a separate document, the medical disclaimer.