Journal policy
Privacy and Personal Data Policy
The publisher processes personal data necessary to operate the journal, peer review, publication, security and research-integrity procedures.
Data controller and contact
Data controller and journal publisher: Non-profit Joint Stock Company S.D. Asfendiyarov Kazakh National Medical University, BIN 181240006407, 94 Tole Bi Street, Almaty 050000, Republic of Kazakhstan. Journal privacy contact: privacy@glr.sciences.kz.
Data collected
- Names, email addresses, ORCID iDs, affiliations, departments, city and country.
- Account credentials stored as password hashes, session identifiers, IP addresses and security logs.
- Manuscripts, authorship declarations, peer reviews, editorial decisions and correspondence.
- Competing-interest, funding, protocol, data-availability and integrity information.
- Uploaded files, audit records, reminders, certificates, complaints and privacy requests.
Purposes and legal basis
Data are processed to provide requested journal services, administer contracts and licences to publish, obtain and document consent where required, comply with legal and scholarly-record obligations, protect legitimate editorial and security interests, investigate misconduct and preserve published research.
Recipients
- Authorized editors, editorial-office staff and technical administrators.
- Reviewers, who receive the information necessary for confidential single-blind assessment.
- Hosting, email, backup and security providers acting for the journal.
- Crossref, ORCID, repositories and indexing services for published or authorized metadata.
- Institutions, funders, ethics bodies or competent authorities when a documented integrity or legal process requires disclosure.
Storage and international transfer
The primary journal platform is hosted through PS.kz infrastructure associated with Kazakhstan. Email delivery, ORCID, Crossref, international reviewers and indexing services may involve processing or transfer outside Kazakhstan. Transfers are limited to the stated purpose and handled under applicable consent, contractual, legal and security safeguards.
Retention schedule
| Record | Normal retention |
|---|---|
| Published articles and public metadata | Permanent |
| Rejected or withdrawn submissions and correspondence | 7 years |
| Peer-review reports and editorial decisions | 7 years |
| Integrity investigation records | At least 10 years |
| Security and access logs | 12 months unless needed for an incident |
| Password-reset tokens | Until expiry or use |
| Session cookie | Until browser/session termination |
Individual rights
Deletion of an account does not require removal of published authorship, the scholarly record, essential audit trails or investigation material that must be retained. Identity verification may be required before acting on a request.
- Request information about processing and access to personal data.
- Request correction of inaccurate data.
- Request restriction, blocking or deletion where no overriding legal, contractual, integrity or preservation duty applies.
- Withdraw consent where processing relies on consent.
- Complain to the journal, publisher or competent authority.
Security and breach response
The platform uses role-based access, password hashing, secure session cookies, CSRF protection, restricted private storage, HTTPS and audit logging. When a personal-data security breach is detected, the journal contains the incident, preserves evidence, assesses risk and changes credentials where necessary. The competent authority is notified within one working day after detection when required by Kazakhstan rules, and affected data subjects are notified when applicable law and the assessed risk require it.
Questions or concerns
Use the appropriate secure route when a matter requires a documented response.