Personal data processing policy

1. General provisions

This Policy defines the procedure for processing personal data and the measures for ensuring its security at Limited Liability Company X7 Insight (the “Operator”) and applies to the websites x7insight.ru and docs.x7insight.ru.

The Policy is drawn up pursuant to part 2 of article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”.

Operator's details

2. The two distinct roles of the Operator — please read this section

The Operator acts in two fundamentally different roles, and they must not be mixed.

As a controller — with respect to website visitors, persons who contact us through the request form, users of the demo environment, and employees and contractors. It is this processing that the present Policy describes.

As a person processing data on a controller’s behalf (part 3 of article 6 of Federal Law No. 152-FZ) — with respect to the data processed in the X7Insight EDC software in the course of clinical trials. The controller of such data is the medical organization, the investigative site or the trial sponsor; the scope of processing operations, the purposes of processing and the protection requirements are established by the contract with that controller. The Operator does not determine the purposes of processing the data of clinical trial participants and does not dispose of that data at its own discretion. This Policy does not extend to such processing — its terms are defined by the controller of the respective data.

3. What data is processed

The Operator does not process special categories of personal data or biometric personal data of persons contacting us through the website.

3.1. Demo request. When the form is filled in, the following is processed: organization name, first and last name of the contact person, email address, organization role (sponsor, contract research organization, investigative site, other), study type and the message text — to the extent the data subject provided voluntarily. The request is sent by email to an internal address of the Operator and is stored in the Operator's mail system.

3.2. Demo environment (“sandbox”). When entering the demo environment without an account, a temporary guest session is created. The following is processed: IP address, browser information (User-Agent), date and time of the start and end of the session, and the actions performed in the demo environment. The data a visitor enters into the demo environment is synthetic and does not relate to real persons; entering information about real people — including yourself — is prohibited.

3.3. Technical logs. The web server records the IP address, date and time of the request, the requested address, the response code and browser information — standard records necessary to keep the website operational and secure.

3.4. What the Operator does not do. The websites carry no third-party visitor counters, no third-party advertising or analytics scripts, no tracking pixels and no cookies intended for behavioural tracking. Browser local storage is used solely to save display preferences (colour theme, interface language, sidebar state); this information never leaves the visitor's device and does not allow identification. A session cookie is set only after a deliberate sign-in to the system or to the demo environment and is required for the session to work.

4. Purposes and legal grounds of processing

No decisions producing legal consequences for the data subject are taken on the basis of solely automated processing of personal data.

5. Procedure and periods of processing

Processing is carried out by mixed means — with and without automation tools — and includes collection, recording, systematisation, accumulation, storage, refinement, retrieval, use, blocking, deletion and destruction.

Databases containing the personal data of citizens of the Russian Federation are located in the territory of the Russian Federation (part 5 of article 18 of No. 152-FZ). No cross-border transfer of personal data is carried out.

Retention periods:

• a request and the related correspondence — until the purpose of processing is achieved: while the exchange about the request continues and for the period established by legislation or contract;
• guest session records of the demo environment (IP address, browser details) — until the purpose of processing is achieved, after which they are anonymized automatically;
• technical logs — until the purpose of processing established for them by the Operator’s internal rules is achieved.

Once the purpose of processing is achieved, or if consent is withdrawn, personal data is destroyed or anonymised within the period established by legislation, unless other legal grounds for its further processing exist.

6. Transfer of personal data

The Operator does not sell personal data and does not pass it to third parties for advertising purposes. Transfer is possible:

• to persons engaged by the Operator to keep its information systems running (equipment hosting and data transmission services in the territory of the Russian Federation) — to the extent necessary to provide the services, under confidentiality terms;
• to state authorities — on the grounds and in the manner established by the legislation of the Russian Federation.

7. Security measures

The Operator takes the legal, organizational and technical measures provided for by article 19 of No. 152-FZ, including: appointing a person responsible for organizing the processing of personal data; limiting the circle of persons with access and segregating access rights; transmitting data over protected channels; logging actions in information systems; backup and recovery; monitoring the measures taken and assessing their effectiveness.

8. Rights of the data subject

The data subject has the right to receive information about the processing of their personal data; to demand its refinement, blocking or destruction where it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing; to withdraw consent to processing; and to appeal against the Operator's actions to the authorised personal data protection authority or in court.

To exercise these rights, or to withdraw consent, it is sufficient to send a request to info@x7insight.ru or by post to the Operator's address. A reply is sent within the period established by legislation.

9. Changes to the Policy

The Operator may amend this Policy. The current edition is always available at https://x7insight.ru/legal/privacy. The edition date is stated at the beginning of the document.