Consent to processing of special-category personal data
TL;DR: everything you upload to Lonevi (documents, lab results, chat with AI) we process as a special category of personal data under the laws of the Republic of Kazakhstan. We store this data encrypted, never share it without your permission, and delete it on request.
Contents
1. Who is the data operator
The personal data operator is Laboratory «DreamLight» (hereinafter — «We»), which manages the Lonevi service (lonevi.com). Contact for data questions: privacy@lonevi.com.
2. What data we process
We process both regular PD (email, name, phone, date of birth) and special-category PD — health data: uploaded medical documents and lab results, your messages in chat with the AI, biomarkers and measurements you enter manually, your medical questionnaire and anamnesis.
For simplicity you agree to a single legal regime: your entire account is processed as special-category PD. We apply enhanced protection measures to all account data, not only the explicitly medical parts.
3. Why we process it
To provide Service functionality: storing the medical card, generating AI responses, analysing uploaded documents, calculating Health Score, educational recommendations. Without this data the Service has no meaning.
4. Legal basis
Your explicit informed consent, expressed at registration (one checkbox «I accept the Terms, the Policy and the Consent»). The laws of the Republic of Kazakhstan permit processing of special-category PD only with such explicit consent.
5. Who has access
Authorised employees of Laboratory «DreamLight» have access — only to the extent needed for development and support. Technical contractors (hosting, AI processing, email delivery, analytics) have access under confidentiality contracts.
We do not sell your data to third parties. We do not pass data to advertisers. We do not pass data to government bodies unless required by Kazakhstan law.
6. Cross-border transfer
Some contractors (such as AI and analytics providers) are located outside the Republic of Kazakhstan, including in the USA. By accepting this document you give consent to cross-border transfer of your data to third countries for the purpose of providing Service functionality. The list of specific processors may change; the current list is available on request at privacy@lonevi.com.
7. Retention
We store data while your account exists. After account deletion a 30-day cooling-off period applies — during this time the account can be brought back: try signing in with your previous password and we will email you a recovery link. Restoring sets a new password and ends every previously issued session. After 30 days all data is hard-deleted irreversibly.
8. Your rights
You have the right to: access your data (including JSON export via the «Download my data» button in settings), correct inaccurate data, delete your account and all data, withdraw consent at any time (withdrawal = account deletion), file a complaint with the Personal Data Protection Agency of the Republic of Kazakhstan (АЗПД РК).
9. Withdrawing consent
You can withdraw this consent at any time by deleting your account in settings. Withdrawal means processing stops and data is deleted on the schedule in section 7. Withdrawal does not have retroactive effect — processing performed before the withdrawal remains lawful.