Personal Data Protection Policy

Introduction
LLC “Akhali Mzera” places great importance on the protection of personal data and respecting the rights of data subjects. This policy aims to ensure the transparency, legality, and security of personal data processing in compliance with the Law of Georgia on Personal Data Protection.

Categories of Data and Processing Purposes
The organization processes personal data strictly in compliance with the law and adheres to high standards of protection.

Categories of Personal Data:

• Identification Data: Name, surname, personal identification number, contact information (phone, email).
• Medical Data: Health condition, medical history, diagnoses.
• Financial Data: Bank details, payments, and insurance information.
• Employment Data: Employee work conditions, position, and work schedule.

The data is processed for the purposes of providing patient services, managing employment relationships, financial settlements, and ensuring security.

Principles of Processing
Personal data is processed lawfully, purposefully, and only to the extent necessary.
The organization ensures:

• The accuracy and timely updating of data;
• Proportional data processing;
• Compliance with high security standards.

Data processing is terminated once the purpose is achieved unless the law requires its retention.

Rights of Data Subjects
Data subjects have the right to:

• Request access to their data;
• Request correction, updating, or completion of their data;
• Request deletion or cessation of data processing unless prohibited by law;
• Refuse automated decision-making.

Video and Audio Monitoring
Monitoring is conducted solely for legitimate purposes, including:

• Ensuring security;
• Improving the quality of services.

Video and audio recordings are stored for a specified period and are protected against unauthorized access.

Security and Incident Management
To ensure data security, the organization applies modern technical and organizational measures, including:

• Physical data protection systems;
• Electronic security programs;
• Employee training on data protection issues.

In the event of an incident, the organization implements measures to mitigate harm and promptly inform data subjects.

Responsibility and Updates
The organization is responsible for the lawful processing of personal data and ensuring the protection of data subjects' rights.
The policy is reviewed and updated regularly to align with regulations, best practices, and organizational needs.