Privacy Policy of the Mitolab Website
Revision dated June 21, 2025
This Privacy Policy (hereinafter the “Policy”) establishes the procedure for the collection, processing, storage and protection of personal data of users of the website located at https://mitolab.kz (hereinafter the “Site”).
The operator organizing the collection and processing of personal data is Sole Proprietor "Nano" (hereinafter the “Operator” or “We”), acting in accordance with the laws of the Republic of Kazakhstan.
1. General Provisions
1.1. This Policy has been developed in accordance with the Law of the Republic of Kazakhstan No. 94-V dated May 21, 2013 “On Personal Data and Their Protection”.
1.2. By using the Site, registering on it or providing his or her personal data, the User (an individual, patient or physician) confirms his or her full and unconditional consent to the terms of this Policy.
1.3. Our business model: The Operator (Sole Proprietor "Nano") provides users with access to two types of services:
- Video training: Sold and provided directly by the Operator.
- Laboratory tests: The Operator accepts the order and payment for the test from the User. The Operator then, in its own name, orders the diagnostic testing service from its contractor, the laboratory LMB Clinic LLP, and provides the User with access to the results through the Site.
1.4. Key terms:
- User: Any individual (patient or physician) using the Site.
- Personal data: Information relating to a personal data subject who is identified or identifiable on the basis of such information, recorded on an electronic, paper and/or other tangible medium.
- Sensitive data: Data concerning the state of health, in this case — laboratory test results.
2. Composition and Categories of Data Collected
2.1. We collect personal data that:
- You provide directly: upon registration, when placing an order or contacting customer support (full name, IIN, gender, contact details, city of residence, place of work and the content of your requests).
- A third party (your attending physician) provides on your behalf: when creating a test for you as an unregistered user (full name, IIN, gender, contact details). These data will subsequently be linked to your account if you register with the same IIN.
- Result from the provision of services: health data (laboratory test results) that we receive from the contractor laboratory for display in your personal account.
2.2. We collect the following data automatically when you use the Site:
- Technical data: IP address, browser type and version, operating system type. These data are collected automatically by the server equipment to ensure the security and stable operation of the Site.
- Cookies: We use strictly necessary technical (session) cookies that are required for the correct operation of the personal account functionality (for example, to keep the user logged in). We do not use analytics or marketing cookies.
3. Purposes of Data Collection and Processing
3.1. We use your personal data for the following purposes:
- Identification: Use of the full name and IIN to unambiguously identify the user (patient) and to link orders and test results to him or her.
- Performance of the contract: To process your orders for video training or laboratory tests, including accepting payment and providing the services.
- Communication: To contact you regarding the fulfillment of orders, to respond to your customer support requests and to send important notifications concerning the operation of the service.
- Providing access to results: To display test results in your personal account, as well as in the personal account of your attending physician if you entered his or her personal code during registration. Providing the physician's code constitutes your consent to that specialist's access to your test results on the Site.
- Record keeping: To automate and simplify the keeping of a test log in the user's personal account.
- Sending notifications: To inform the User of the order status and the readiness of test results, as well as to send the Company's news and special offers.
4. Transfer of Data to Third Parties
4.1. We do not sell your personal data. We transfer it to third parties only in the following cases and to achieve the purposes described in this Policy:
- To the partner laboratory: We transfer your identification data (full name, IIN, gender and other necessary information) to LMB Clinic LLP to perform the laboratory test you ordered. In turn, we receive your test results from the laboratory in order to display them in your personal account.
- To payment systems: When paying for an order, you are redirected to the website of the payment system "tip top pay". We do not collect, store or process your bank card data. All operations involving payment data take place on the side of the secure payment gateway.
- To government authorities: Solely on the grounds and in the manner established by the laws of the Republic of Kazakhstan.
4.2. In the future, we may use third-party services to send SMS and email notifications. In that case, we undertake to select partners that ensure an adequate level of data protection.
5. Data Storage and Protection
5.1. Protection: We take the necessary technical and organizational measures to protect your data from unauthorized access, alteration, disclosure or destruction. The Site uses an SSL certificate that encrypts the data transmitted between your browser and our server. Access to personal data within our organization is strictly regulated.
5.2. Storage location: All users' personal data are stored on servers physically located in the territory of the Republic of Kazakhstan (hosting provider ps.kz).
5.3. Retention period: We store your personal data, including your test history, for the entire lifetime of your account, for your convenience and to allow you to track changes in your health parameters over time. You have the right to request the deletion of your account and all personal data associated with it at any time.
6. Rights and Obligations of the User
6.1. The User has the right:
- To access data: To view his or her personal data and test history in the personal account on the Site.
- To rectify data: To request the correction or completion of his or her personal data if it is inaccurate or incomplete.
- To delete data: To request the deletion of his or her account and all personal data associated with it.
6.2. To have data corrected or deleted, the User must contact the Operator's customer support using the contact details specified in Section 9 of this Policy.
6.3. The User undertakes to provide accurate information about himself or herself and to keep it up to date.
7. Notifications and Informational Mailings
7.1. Service notifications. By using the Site and ordering the Services (for example, by clicking the “Pay” or “Order” buttons or by completing registration), the User consents to receive service email and/or SMS notifications necessary for the proper provision of the Services. Such notifications include, for example, messages confirming an order, an appointment time or the readiness of test results.
7.2. Marketing mailings. The Company has the right to send the User notifications about new products and services, special offers and various events. The User may opt out of receiving such messages by sending the Company an email to mitolab.kz@yahoo.com marked “Opt out of notifications”.
8. Amendments to the Privacy Policy
8.1. We reserve the right to amend this Policy. The new version of the Policy takes effect from the moment of its publication on the Site, unless otherwise provided by the new version.
8.2. We recommend that Users regularly check this Policy for updates.
9. Contact Information
9.1. If you have any questions, suggestions or requests related to the processing of your personal data under this Policy, please contact us: