PRIVACY POLICY at MZ MEDICAL
Last updated: 30 October 2026
1. DATA CONTROLLER AND SCOPE
MZ Medical is operated by mariazalazarmedical OÜ, a company registered in Estonia.
This Privacy Policy explains how MZ Medical collects, uses, stores, protects and shares personal information relating to website visitors, patients, consultation clients, questionnaire participants, healthcare professionals, business clients, investors and partners.
We respect applicable data protection laws, including the EU General Data Protection Regulation (GDPR), UK GDPR, Estonian data protection legislation and other applicable national or international privacy requirements.
The application of particular laws depends on the individual’s location, the services provided and the nature of the processing.
Data protection enquiries: info@mz-medical.com
Website: https://mz-medical.com
2. PERSONAL INFORMATION WE COLLECT
Depending on the service or interaction, we may collect:
Personal information: Name, contact details, email address, location and relevant identification information.
Medical information: Symptoms, diagnoses, medical history, investigations, surgical procedures, prescribed treatments, treatment responses, clinical records and other health information voluntarily provided.
Questionnaire information: Experiences relating to endometriosis, menopause, chronic symptoms, healthcare access, diagnostic delays, quality of life and unmet healthcare needs.
Professional information: Qualifications, professional interests, organisational details and healthcare service information.
Business information: Company documents, financial or commercial information, investment proposals, confidential communications and advisory project materials.
Administrative information: Appointment bookings, invoices, payment confirmations and service communications.
Technical information: Website usage, browser information, security logs, cookies and other information generated through website interactions.
We seek to collect only information relevant and necessary for specified purposes.
Medical information is treated as sensitive personal data and receives additional protection.
3. PURPOSES OF PROCESSING
Personal information may be processed to:
Respond to enquiries and requests.
Provide consultations, medical education, second opinions and other agreed services where legally permitted.
Manage appointments, payments and professional communications.
Understand patient experiences and identify unmet healthcare needs.
Conduct questionnaires supporting healthcare service development and validation.
Develop and evaluate digital health services.
Manage professional advisory services, business partnerships and confidential commercial engagements.
Undertake research where applicable legal, ethical and regulatory requirements have been satisfied.
Maintain website functionality, security and administrative records.
Comply with applicable legal and professional obligations.
Information collected for one purpose will not automatically be used for an unrelated purpose without an appropriate legal basis and any additional required safeguards.
4. ENDOMETRIOSIS AND OTHER HEALTH QUESTIONNAIRES
MZ Medical may invite individuals to complete voluntary questionnaires concerning endometriosis, menopause and other healthcare topics.
These questionnaires may collect information about symptoms, diagnoses, previous investigations, surgery, treatment experiences, quality of life and healthcare needs.
The purpose is to understand patient experiences, identify unmet needs and inform the evaluation and development of healthcare services.
Participation is voluntary.
Where consent is relied upon, participants must provide explicit, informed consent before submitting identifiable health information.
Questionnaire participation does not constitute a medical consultation, diagnosis or treatment recommendation and does not establish a doctor–patient relationship.
Questionnaire participation does not automatically authorise the use of identifiable information in future clinical research.
Any further research involving identifiable patient information will be subject to the applicable legal basis, confidentiality requirements and ethical or regulatory approvals where required.
5. LEGAL BASIS FOR PROCESSING
Under the EU GDPR and UK GDPR, where applicable, personal information is processed on an appropriate legal basis under Article 6.
These may include:
Consent under Article 6(1)(a).
Contractual necessity under Article 6(1)(b).
Compliance with legal obligations under Article 6(1)(c).
Legitimate interests under Article 6(1)(f), where those interests are not overridden by individual rights.
For voluntary health questionnaires relying on consent, identifiable health information is processed on the basis of explicit consent under Article 9(2)(a).
For clinical care and related medical services, different lawful bases and Article 9 conditions may apply according to the circumstances and relevant professional obligations.
Consent may be withdrawn at any time by contacting info@mz-medical.com.
Withdrawal does not affect processing lawfully completed before the withdrawal.
6. PATIENT INFORMATION AND MEDICAL CONFIDENTIALITY
Medical information is handled with particular care because of its sensitive and confidential nature.
Information provided during consultations or second-opinion services is used for the agreed service and related lawful administrative and professional purposes.
Access is restricted to authorised individuals who require the information for legitimate purposes.
Medical information is not disclosed to employers, insurers, investors or unrelated third parties merely because a person uses MZ Medical services.
Disclosure may occur with appropriate authorisation, where necessary for an agreed service, or where legally required or otherwise permitted by applicable law.
Patients should use an authorised secure method for submitting medical records when one is provided.
Ordinary email may present confidentiality risks and should not be assumed to provide the same protection as a dedicated secure medical-record transfer service.
7. SHARING WITH SERVICE PROVIDERS
MZ Medical may use external service providers for website hosting, form management, email, document storage, appointment scheduling, communications, payments, security and administration.
Our website uses WordPress and Hostinger, and certain questionnaires use Fluent Forms.
Other service providers may include Google services, booking platforms, payment processors and professional software providers, according to the services actually used.
Where a provider processes personal data on our behalf, appropriate contractual and security arrangements are required under applicable law.
Personal information is shared only where there is a legitimate and lawful purpose.
MZ Medical does not sell identifiable patient health information.
8. DATA STORAGE AND SECURITY
MZ Medical seeks to maintain appropriate technical and organisational security measures to protect personal and confidential information.
These include, where applicable:
Secure website connections.
Access controls and account permissions.
Authentication and account protection.
Restricted access to confidential records.
Appropriate backup and recovery arrangements.
Security monitoring and software maintenance.
Secure handling of confidential business and medical documents.
Our current website hosting server is located in the United Kingdom, with backups in Germany.
Other providers may use different processing or storage locations.
No electronic system is completely free from risk. MZ Medical does not claim that any system provides absolute protection against every possible security incident.
Where a personal data breach occurs, we will assess it and notify the relevant authorities and affected individuals where required by applicable law.
9. INTERNATIONAL DATA TRANSFERS
MZ Medical operates internationally and may provide services or communicate with individuals and organisations in different countries.
Personal information may be processed in the United Kingdom, the European Economic Area or other locations where authorised service providers operate.
When international transfers occur, the applicable legal requirements are assessed.
Where required, appropriate safeguards may include recognised adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or other legally recognised mechanisms.
International access or disclosure does not remove the obligation to protect confidential medical and business information.
10. DATA RETENTION AND DELETION
Personal information is retained only for as long as necessary for its legitimate purpose, taking account of contractual, medical, legal, accounting and regulatory obligations.
Retention requirements differ according to the category of information.
Medical records are retained according to applicable professional and legal record-keeping obligations.
Questionnaire responses are retained for the period reasonably necessary to complete the stated evaluation or service-development purpose, subject to any applicable legal requirements.
Business and advisory information is retained according to contractual needs, confidentiality commitments and applicable legal obligations.
Financial records are retained for the relevant statutory accounting and tax periods.
Where retention is no longer justified, information will be securely deleted or anonymised as appropriate.
Individuals may request details of the applicable retention criteria and, where legally entitled, request deletion of their information.
11. GOOGLE DRIVE AND CONFIDENTIAL BUSINESS DOCUMENTS
MZ Medical may use Google Drive or other authorised document-storage services for professional and administrative work.
Patient records, advisory client documents and confidential business information should be managed separately, with appropriate restrictions on access and sharing.
Access should be limited to authorised individuals.
Confidential documents must not be made publicly accessible through unrestricted sharing links.
Account protection, permissions and document retention are reviewed according to the information’s sensitivity.
12. AI-ASSISTED TOOLS
MZ Medical may use artificial intelligence tools for administrative support, drafting, analysis, education or other professional activities.
The use of AI-assisted tools does not replace independent professional judgement.
Any use involving identifiable personal or medical information must have an appropriate legal basis and comply with applicable confidentiality, security and data protection requirements.
Relevant provider arrangements, international transfers and other processing risks must be assessed before sensitive information is submitted.
AI-generated material used in professional services remains subject to appropriate human review.
Questionnaire participation does not automatically authorise identifiable patient information to be uploaded to external AI systems or used to train AI models.
13. RESEARCH AND SERVICE DEVELOPMENT
MZ Medical may undertake healthcare research, surveys, service evaluation and digital healthcare development.
Information used for these purposes will be processed according to the applicable legal basis and relevant safeguards.
Where possible and appropriate, identifiable information may be minimised, pseudonymised or anonymised.
Pseudonymised information remains personal data where re-identification is possible.
Anonymised information is no longer personal data only where individuals cannot reasonably be identified.
Research participation and secondary uses of health information may require additional information, consent, ethical review or other legal authorisation depending on the activity.
14. COOKIES AND WEBSITE ANALYTICS
Our website may use cookies and similar technologies for essential functionality, website security, performance monitoring and analytics.
Where required by applicable law, consent will be requested before non-essential cookies or similar tracking technologies are activated.
Visitors may manage preferences through available website controls and their browser settings.
Information obtained through analytics is handled according to applicable privacy requirements.
15. INDIVIDUAL PRIVACY RIGHTS
Depending on the applicable law and circumstances, individuals may have the right to:
Access personal information held about them.
Request correction of inaccurate information.
Request deletion of eligible personal information.
Request restriction of processing.
Object to certain processing activities.
Request data portability where applicable.
Withdraw consent where processing is based on consent.
Raise concerns about the handling of their information.
Requests may be submitted to info@mz-medical.com.
MZ Medical will respond within the legally required timeframe.
Appropriate identity verification may be requested before disclosing sensitive information.
Certain rights may be limited where continued processing is required by law or other lawful exemptions apply.
16. CHILDREN AND VULNERABLE INDIVIDUALS
Where services or questionnaires involve children or individuals requiring additional safeguards, the relevant legal requirements concerning consent, parental responsibility, capacity and confidentiality must be respected.
General website access does not constitute permission to collect sensitive information from minors without the safeguards required by applicable law.
17. PRIVACY COMPLAINTS AND SUPERVISORY AUTHORITIES
Individuals are encouraged to contact MZ Medical directly with any concern about the handling of their personal information.
Email: info@mz-medical.com
Individuals may also complain to a competent supervisory authority.
Estonia:
Estonian Data Protection Inspectorate
https://www.aki.ee/en
United Kingdom:
Information Commissioner’s Office
https://ico.org.uk
European Union:
Individuals may contact the competent data protection authority in their relevant EU member state.
Other countries:
Individuals may have additional rights or complaint procedures under applicable local privacy legislation.
18. INTERNATIONAL PRIVACY COMPLIANCE
MZ Medical recognises that privacy and medical confidentiality requirements vary between jurisdictions.
Where applicable, MZ Medical will assess obligations arising under relevant national laws, including laws governing sensitive health information, consumer privacy and international data transfers.
The GDPR and UK GDPR do not replace or automatically satisfy other countries’ legal requirements.
In the United States, HIPAA applies only where the relevant organisation, activity and information fall within its legal scope.
Additional requirements may apply to particular healthcare services, medical records, research activities or international operations.
19. AUTOMATED DECISION-MAKING
Completing a questionnaire does not, by itself, authorise automated medical diagnosis or treatment decisions.
Where automated processing or profiling subject to specific legal requirements is introduced, affected individuals will receive the additional information and safeguards required by applicable law.
20. CHANGES TO THIS POLICY
MZ Medical may update this Privacy Policy to reflect changes in services, legislation, technology, data-processing activities and professional obligations.
The current version will be published on the MZ Medical website with the relevant revision date.
For privacy enquiries, requests or complaints:
MZ Medical
mariazalazarmedical OÜ
Estonia
Email: info@mz-medical.com
Website: https://mz-medical.com
