Consent to the Processing of Personal Data
Last updated: September 2026.
This document sets out the standard text of the consent given by a user (a specialist) when registering in the Service, and also explains what consent the specialist user must obtain from their patients before uploading their data to the Service.
1. The user’s consent to the processing of their own data
By registering in the Ceph Service, I freely, of my own will and in my own interest give consent to the operator [operator name] to process the following personal data of mine: username, email address, and technical data (session information, history of support requests) — for the purposes of registration, authentication, provision of the Service and technical support, by the means described in the Privacy Policy and the Data Retention Policy, for the duration of my account. I may withdraw this consent at any time by contacting the address given in the Privacy Policy; withdrawal of consent results in termination of access to the Service and erasure of the data in the manner set out in the Data Retention Policy.
2. Consent to the processing of special categories of data (patients’ medical data)
The patient data that a user uploads to the Service (cephalogram images, full name, date of birth, sex, analysis results) belongs to a special category of personal data — data concerning health (Art. 10 of Federal Law 152-FZ in the Russian Federation; Art. 9 GDPR in the EU; “Protected Health Information” within the meaning of HIPAA in the USA). Processing such data requires the separate explicit consent of the data subject (the patient) or their legal representative.
By registering and uploading patient data to the Service, the specialist user confirms and warrants that:
- they have obtained from the patient (or the patient’s legal representative) separate written (including electronic) consent to the processing of personal health data, including its transfer to the Service’s information system and storage in it;
- such consent was obtained in a form that meets the requirements of the law of the country where the medical activity is carried out (in the Russian Federation — a form meeting Art. 10 and 9 of 152-FZ; in the EU — the requirements of Art. 9(2)(a) GDPR or another applicable ground under Art. 9(2), for example the provision of healthcare);
- they bear full responsibility to the patient and to the competent authorities for the lawfulness of obtaining such consent and for the lawfulness of uploading the patient’s data to the Service;
- they will inform the patient of the right to request erasure of their data from the Service and will ensure that such a request is fulfilled through the Service administrator.
The Service operator has no direct contact with patients and cannot independently verify that such consent was obtained — responsibility for this, as stated above, lies with the registered specialist.
3. Standard patient consent form (a sample for the specialist)
“I, [name of patient / representative], consent to [name of clinic / specialist] processing my personal data, including data on my state of health and the results of an X-ray examination, including its transfer to the Ceph information system used by the specialist for cephalometric analysis and storage of results, for the period of medical care and for the retention period of medical records established by law. I have been informed of my right to withdraw this consent at any time by contacting [name of clinic / specialist].” Signature, date.
This is a sample text for the specialist’s own use with their patients outside the Service — the Service operator does not collect patients’ signatures directly.
4. Withdrawal of consent
Consent can be withdrawn at any time through the support chat in the personal account or by the email given in the Privacy Policy. Withdrawal of consent to the processing of the user’s own data results in deactivation and subsequent deletion of their account within the periods set out in the Data Retention Policy.
This is a standard template and does not replace legal advice. The wording of consents, especially for special categories of health data, must be reviewed by a lawyer taking into account the operator’s country of registration and the countries from which patient data comes.