Privacy and Medical Data Notice
Last updated: 23 August 2026
This notice explains how personal data is processed through drarakelyan.com, its contact and consultation forms, assessment-photograph uploads, and related patient communications.
Controller and contact
For website enquiries and preliminary consultation requests, the personal-data controller is Dr. Telman Arakelyan, Yerevan, Armenia. Privacy requests may be sent to telmanarakelyan@doctor.com or made by telephone at +374 55 775 705. Surgery is performed at Slavmed Medical Center where clinically arranged; the hospital and other participating healthcare providers may act under their own legal responsibilities for the medical records they create.
Applicable law and EEA visitors
Processing is governed primarily by the Republic of Armenia Law on Protection of Personal Data and Armenian rules concerning medical secrecy and healthcare records. Armenia is outside the European Economic Area and is not currently covered by a European Commission adequacy decision. Where services are intentionally offered to people who are in the European Union or European Economic Area and the territorial scope of the EU General Data Protection Regulation applies, the relevant GDPR requirements also apply.
Data collected
The practice may collect your name, telephone number, email address, country, preferred procedure, preferred contact method, proposed treatment timing, previous-surgery information, messages and other consultation details. If you choose to provide them, the practice may also collect assessment photographs, medical history, medicines, allergies, diagnoses, symptoms and other health information. Technical data may include IP address, browser and device information, referral or campaign information, cookie-preference choices, security records and basic website-use events.
Purposes and legal bases
Ordinary enquiry information is used to answer and manage your request, take steps you ask for before a consultation or care arrangement, coordinate appointments and travel, maintain necessary administrative records, protect the forms and website from misuse, comply with legal duties and establish or defend legal rights. Depending on the activity and the law that applies, the basis may be your request and consent, steps taken before entering an arrangement, legitimate interests in secure and effective practice administration, or a legal obligation.
Medical information and assessment photographs are special-category personal data. For a preliminary online assessment, they are processed on the basis of your separate explicit consent. If treatment or continuing care is arranged, relevant information may also be processed under applicable healthcare, medical-record and patient-safety rules.
For website measurement, Google Analytics and Google Ads technologies are currently enabled by default for new visitors under an opt-out preference model. You can disable optional analytics, advertising and chatbot technologies at any time through the persistent “Cookie settings” control. The website is configured not to intentionally send consultation messages, uploaded photographs, names, telephone numbers, email addresses or selected procedures to Google Analytics or Google Ads as analytics event data. More detail is provided in the Cookie Information page.
Consent and consent records
The consultation forms separate consent to be contacted from explicit consent to process voluntarily submitted medical information and assessment photographs. Submission records may include the consent choices, date and time, form and language used, and related security information so that the practice can demonstrate the context in which consent was given. You may withdraw consent for medical-data processing at any time by using the contact details above. Withdrawal does not affect processing already carried out lawfully, but it may prevent completion of the requested assessment or service. Cookie and analytics preferences are managed separately through the website’s Cookie settings control.
Processing operations
Depending on the purpose, processing may include collecting, recording, organizing, storing, reviewing, using, correcting, restricting or blocking, securely transmitting to an authorized recipient, deleting, anonymizing or destroying personal data.
Health information, photographs and medical secrecy
Medical information and assessment photographs are treated as confidential and are accessible only to authorized clinical or coordination personnel and service providers who need them for the stated purpose. Consent to assessment does not authorize publication, advertising, social-media use, teaching use or inclusion in a before-and-after gallery. Any such use requires separate, specific authorization. A website submission provides a preliminary enquiry and does not by itself establish a doctor-patient relationship or guarantee that treatment will be offered.
Recipients and service providers
Data may be disclosed only as reasonably necessary to Dr. Arakelyan, authorized members of the clinical and patient-coordination team and, when care is being arranged, the hospital, anesthesiology team, laboratories or other participating healthcare professionals. Operational providers may include Webflow for website hosting, forms and file uploads; selected email and messaging services; security and anti-spam services; Google services for website analytics and advertising while optional tracking remains enabled; and Cronbot, which may load while optional technologies are enabled and processes message content only if you use the chatbot. Personal data is not sold. Disclosure may also occur where required by law, necessary to protect patient safety or needed to establish, exercise or defend legal rights.
Processing in Armenia and international transfers
Your enquiry is reviewed and coordinated in Armenia. Because Armenia is outside the EEA, personal data submitted by an EEA visitor is processed in a third country. Some website, hosting, communications and technology providers may also process data outside Armenia or outside the country where you live. Transfers are made only where permitted under Armenian personal-data law and, where the GDPR applies, must use an applicable transfer mechanism, contractual safeguard, derogation or other lawful basis. Do not send unnecessary medical information through social-media, ordinary messaging or chatbot services.
Retention
Consent for an online consultation enquiry remains effective until the enquiry is completed, you withdraw it or the data is no longer needed for the stated purpose. If no treatment or continuing care is arranged, online enquiry information and assessment photographs are normally deleted or de-identified within 12 months after the last meaningful contact, unless longer retention is reasonably required for a complaint, legal claim, security investigation or legal obligation. If care is accepted, information relevant to treatment may become part of the medical record and be retained for the periods required by Armenian healthcare and archival rules. Limited consent, security and transaction records may be retained where necessary to demonstrate compliance and prevent abuse.
Security
Reasonable technical and organizational safeguards are used, including access limitation, confidentiality duties and secure service configurations. Sensitive information should be sent only through the designated form or an agreed clinical communication channel. No internet transmission or storage system can be guaranteed completely secure.
Your rights
Subject to applicable law, you may request information about processing, access to your data, correction, restriction or blocking, deletion or destruction, and withdrawal of consent. Where the GDPR applies, additional rights may include objection and data portability. Identity verification may be required, and some information may be retained where law, medical-record duties, patient safety or legal claims require it.
Children
A person under 16 should not submit health information or photographs without the consent of a parent or legal representative. A parent or legal representative should contact the practice regarding a minor.
Complaints
You may first contact Dr. Arakelyan using the privacy contact details above. Complaints concerning Armenian personal-data law may also be addressed to the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia, 54b Komitas Avenue, Yerevan 0051, Armenia; email: pdpa@justice.am; telephone: +374 10 594 194. Where the GDPR applies, you may also have the right to complain to the competent EEA supervisory authority.
Changes
This notice may be updated when the practice’s services, providers or legal obligations change. The current revision date will be shown at the top of this page.
