Skip to content
რა მჭირს?

Data protection

Last updated: Thu Oct 01 2026 04:00:00 GMT+0400 (Georgia Standard Time)

Data protection commitments

Ramchirs processes personal data — including health-related data, which the law treats as a special category — under the following commitments, aligned with the Georgian Law on Personal Data Protection and the principles of the GDPR.

Lawful basis

  • Explicit consent for health-data processing: account creation records consent to store the assessment results you explicitly choose to save; the save action itself is a second, per-result confirmation. Anonymous screenings involve no server-side health-data processing at all.
  • Contract for account service delivery (authentication, dashboard operation).
  • Legitimate interests for security logging (rate limiting, abuse prevention) — minimized, hashed where possible, short-retention.

Data protection by design

  • Data minimization: anonymous-first architecture; the server never sees anonymous screening answers.
  • Pseudonymization: session tokens stored as hashes; IP addresses hashed in logs.
  • Encryption: TLS in transit; scrypt password hashing; access controls at rest.
  • Access control: role-based admin access; all admin access to user data is audit-logged.
  • Retention: account data retained while the account exists; deleted on account deletion. Verification tokens expire in 24 hours. Sessions expire in 30 days of inactivity.

Special category data

Assessment responses are health-related data. They are: never sold; never shared with advertisers, ad networks, clinics, sponsors, or analytics platforms; never used for profiling; never included in aggregate statistics that leave the platform; visible only to you (and to support staff only when you initiate a support request that requires it, under confidentiality obligations).

Your rights

Access, rectification, erasure, restriction, portability (JSON export), and objection. Exercise them via Dashboard (self-service) or the contact form; we respond within 30 days. You may complain to the Personal Data Protection Service of Georgia (personaldata.ge).

Breaches

Material personal-data breaches affecting your data will be notified to you and to the supervisory authority as the law requires.

Contact

Data protection requests: use the contact form and select "Privacy request".