What we collect

​

A) Website & forms
Name, phone/WhatsApp, email, and any message you provide. 

B) Messaging (WhatsApp)
If you start a WhatsApp chat, your phone number and message content are processed by WhatsApp to deliver the conversation under WhatsApp’s policies. WhatsApp.com

C) Usage data & cookies
Device/browser information, pages viewed, referrers, approximate location and events (e.g., clicks).
— Analytics: we may use Google Analytics 4, which does not log or store IP addresses and derives only coarse geolocation before discarding IP. Google Help

D) Patient records (after you are seen in consultation)
If you proceed to clinical care, your record is created and stored in the hospital EMR. In Abu Dhabi, providers also participate in the Malaffi Health Information Exchange (AD DoH initiative) for secure, real-time clinical data sharing. Department of Health Abu DhabiMalaffi

 

How we use your data

​

• Respond to enquiries and schedule consultations.

• Prepare for care and, once you are seen, create/update your clinical record.

• Operate and secure the website and forms (spam prevention, availability).

• Analyze site usage (aggregated) to improve content and navigation.

• Send updates/marketing only with your consent (e.g., WhatsApp follow-ups).

• Meet legal, regulatory and insurance obligations.

 

Legal bases (PDPL)

​

Depending on context, we rely on your consent (e.g., optional uploads/marketing), performance of a contract or pre-contract steps (scheduling, responding), legal obligations (health record rules), public interest/public health bases where applicable to clinical data. You can withdraw consent anytime without affecting prior lawful processing. UAE Legislation

 

Cookies & consent

​

We use necessary cookies for security and core site functions. With consent, we may use analytics/functional/advertising cookies (varies by your choices in our cookie banner). You can change preferences anytime via the “Manage cookies” link or privacy trigger in the footer. 

 

Sharing & recipients

​

• Hospital & care team: If you proceed to treatment, relevant data transfers to Elyzee Hospital for clinical use and record keeping; Abu Dhabi providers exchange data through Malaffi (DoH Abu Dhabi HIE) per local policy. Department of Health Abu Dhabi+1

• Service providers (processors): We use vetted vendors to host/operate the site and communications (e.g., Wix for hosting/forms; WhatsApp for messaging; Google for analytics). Wix provides a Data Processing Agreement and maintains a public list of sub-processors and data-storage information. Wix Support+1wix.com

• Legal & compliance: We may disclose where required by law or to establish, exercise, or defend legal claims.

• We do not sell personal data.

 

International (cross-border) transfers

​

Because some processors are global (e.g., Wix, Google, WhatsApp), your data may be transferred outside the UAE. We follow PDPL cross-border mechanisms (adequacy, safeguards/contractual clauses, or explicit consent where applicable). UAE.gov

 

Retention

​

• Clinical health records: Retained not less than 25 years from the date of your last health procedure, as required by the UAE ICT Health Data Law (Art. 20). UAE Legislation under Elyzee Hospital Management.

• Website enquiries & pre-consultation uploads: Typically 24 months from last interaction (or sooner if you ask us to delete), unless required longer by law or to resolve disputes.

• Cookie consent logs: Retained by the consent platform to demonstrate compliance. Wix Support

 

Your privacy rights (PDPL)

​

Subject to legal exceptions, you may request to:

• Access your data or obtain a copy/portability;

• Correct or erase personal data;

• Restrict or stop processing (including stop marketing);

• Object to solely automated decisions that produce legal/similarly significant effects;

• Receive information on our processing activities.
  Contact us using the details above. You can also lodge a complaint with the UAE Data Office (federal data regulator). UAE.gov

 

Security

​

We apply appropriate technical and organizational measures (encryption, access controls, logging, least-privilege, secure hosting) and require our processors to implement comparable safeguards. (PDPL expects controllers/processors to ensure security appropriate to risk.) UAE Legislation

 

WhatsApp, email & uploads

​

WhatsApp is end-to-end encrypted for messages; metadata and device information may still be processed under WhatsApp’s privacy policy. Please avoid sharing highly sensitive details over chat; we will collect clinical data directly during care and store it securely. WhatsApp.com

 

Children

​

We do not knowingly collect information from children under 18 via website forms. Clinical care for minors is handled directly with appropriate parental/guardian consent.

 

Before & After images and testimonials

​

We publish images/testimonials only with written consent. We de-identify each case. You can withdraw website image consent at any time; removal does not affect our legal requirement to retain the clinical record copy.

 

Changes to this Policy

​

We may update this Policy to reflect changes in services, laws or guidance. The effective date shows the latest revision.

 

Controller details

​

For website interactions and pre-consultation enquiries, the controller is Dr. Bravo Plastic Surgery (details above). For treatment delivered at Elyzee Hospital, your clinical record is handled within the hospital EMR and subject to hospital policies and Abu Dhabi Malaffi participation. Department of Health Abu Dhabi