Privacy Policy

Under the Personal Data Law as amended with effect from 27 March 2026 (Law No. ZRU-1125), mandatory storage on servers located in Uzbekistan applies only to specific categories of personal data — in particular biometric and genetic data and certain telecommunications-operator data. Prosta does not collect biometric or genetic data and is not a telecommunications operator, so no data we process falls under the mandatory localization categories.

Other personal data (such as your name, email address, phone number, and city) may lawfully be stored and processed on secure servers outside Uzbekistan, provided the statutory conditions are met: compliance with established information security requirements, adherence to international personal data protection standards, and oversight by the authorized state bodies of the Republic of Uzbekistan. Prosta stores personal data on secure cloud infrastructure meeting these conditions, with the safeguards described in Sections 8 and 10.

Providers you book with. When you make a booking, the Provider receives your name, contact details, and the booking information — solely to deliver the appointment. Providers are contractually prohibited from using your data for their own marketing or sharing it further without your separate consent.

Payment providers. If you pay online, the payment itself is processed by a licensed external payment service provider on its own systems (identified at checkout). Card details never pass through or reside with Prosta.

Infrastructure service providers acting only on our instructions (processors) — the technical vendors any modern app requires to function: cloud hosting and database infrastructure, SMS/email delivery services for sending your OTP codes and booking notifications, push notification delivery, crash reporting, and analytics. These vendors process data strictly under our instructions and data processing agreements, cannot use it for their own purposes, and are bound by confidentiality.

State authorities — only where disclosure is required by the legislation of the Republic of Uzbekistan or other applicable law, pursuant to a lawful and binding request (court, law enforcement, tax authority), or where necessary to protect the rights and safety of Prosta, our users, or the public, or to establish, exercise, or defend legal claims.

Business transfers. If Prosta is involved in a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the successor under confidentiality obligations; this Privacy Policy will continue to apply and you will be notified of any change of operator.

Access — confirmation of processing and a copy of your data;

Correction — fixing inaccurate or incomplete data (you can edit your name, email, phone, and city directly in the app);

Deletion ("right to be forgotten") — deletion of your data where no overriding legal ground requires retention;

Restriction / blocking — temporary limitation of processing in the cases provided by law;

Objection — objecting to processing based on legitimate interests, and to direct marketing at any time with immediate effect;

Withdrawal of consent — at any time, without affecting prior lawful processing;

Data portability — receiving your data in a structured, commonly used, machine-readable format;

Complaint — lodging a complaint with the authorized personal data protection body of the Republic of Uzbekistan or, for EU/EEA residents, with your local supervisory authority (for example, UODO in Poland).

You can delete your account and data at any time:

• In the app: Settings → Account → Delete Account;
• By emailing support@prosta.uz from your registered email or phone-verified request.

Upon a verified request, your account is deactivated immediately and your personal data is deleted or anonymized within 30 days, in line with the GDPR's "without undue delay" standard. We retain only what the law requires us to keep (payment and accounting records — Section 5), in restricted storage, and delete it when its retention period expires.

Deleting the app from your device does not delete your account — use one of the methods above.

As described in Section 3, the data we collect is not subject to mandatory localization in Uzbekistan, and our infrastructure vendors (Section 4.3) may operate outside Uzbekistan, including in the EU/EEA and the USA.

Any cross-border transfer takes place only: (a) under the conditions of the Personal Data Law as amended — to jurisdictions ensuring an adequate level of protection (per the list to be approved by the Cabinet of Ministers), or on another lawful basis such as your consent, contractual safeguards, or compliance with recognized international data protection standards; and (b) for data of EU/EEA users, under GDPR Chapter V safeguards — an adequacy decision or the European Commission's Standard Contractual Clauses concluded with the relevant vendor, with supplementary measures where needed.

We use cookies, SDKs, and local storage to: keep you signed in; remember your language and city; ensure security and prevent fraud; and understand aggregate usage so we can improve the Platform.

Categories: strictly necessary (sign-in, security — cannot be disabled), functional (preferences), and analytics. Analytics that require consent under EU rules (ePrivacy/GDPR) are activated for EU users only after consent via the cookie banner.

You can manage cookies in your browser settings and via our cookie settings where offered, and reset or limit mobile advertising identifiers in your device settings. Disabling some cookies may impair sign-in or other features.

We apply technical and organizational measures appropriate to the risk, including: passwordless OTP authentication (no password database to breach); encryption of data in transit (TLS) and at rest; role-based access on a least-privilege basis; environment segregation; logging and monitoring; regular backups; vulnerability management; confidentiality obligations for personnel; data processing agreements with all vendors; and a documented incident response procedure.

If a personal data breach occurs, we will act in accordance with applicable law: for EU/EEA users' data, notifying the competent supervisory authority within 72 hours where required by Art. 33 GDPR and affected users without undue delay where the breach is likely to result in a high risk to them; and notifying the authorized Uzbek body and affected users as required by the Personal Data Law.

Keep your email inbox, phone number, and Telegram/Google/Apple accounts secure — they are the keys to your Prosta account. Never share one-time codes with anyone; Prosta staff will never ask for your OTP.

We send marketing messages (offers, promotions, news) via push, SMS, email, or messaging apps only with your consent.

You can opt out at any time via notification settings in the app, the unsubscribe link in emails, or by contacting support. Opt-outs take effect without undue delay.

Transactional messages (OTP codes, booking confirmations, reminders, security alerts) are an integral part of the Service and are sent regardless of marketing preferences while your account is active.