Privacy Policy

1. Introduction

Maison Santé (“Maison Santé”, “we”, “us” or “our”) is a preventive and integrative medicine clinic and pharmacy based in Dubai, United Arab Emirates, licensed by the Dubai Health Authority (DHA), DHA licence number: 6212085, MOH License: C5HDMY4X-140726. We are committed to protecting your privacy and to handling your personal and health information responsibly, transparently and securely.

This Privacy Policy explains what information we collect about you, how we use and protect it, who we share it with, and the rights you have. It applies to our website (maisonsante.ae), our clinic and pharmacy services, and any forms, questionnaires, applications or communication channels we provide.

We handle your information in accordance with the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields (the “ICT Health Law”), the UAE Medical Liability Law, and the regulations and standards of the Dubai Health Authority.

2. Information we collect

Depending on how you interact with us, we may collect the following categories of information:

Personal and contact details — your full name, date of birth, gender, nationality, Emirates ID or passport details, and contact information such as phone number, email and address.

Health and medical information — as a healthcare provider, we hold information about your health as part of your care. This may include your medical history, symptoms and reasons for visit, questionnaire and assessment responses (for example, wellbeing, sleep or lifestyle questionnaires), examination findings, laboratory and diagnostic results, biomarkers, diagnoses, treatment and care plans, prescriptions, and medication and dispensing records from our pharmacy. This is treated as strictly confidential.

Appointment and service information — bookings, preferred practitioner or service, visit history and related notes.

Payment and insurance information — billing details, payment records, insurance provider, membership or policy details, and information needed to process claims and reimbursement.

Communications — messages, enquiries and correspondence you send us by email, telephone, WhatsApp, website chat or contact forms, and our records of these exchanges.

Website and technical information — when you use maisonsante.ae we may collect your IP address, device and browser type, pages viewed, and similar analytics data through cookies and comparable technologies (see “Cookies and analytics”, below).

3. How we collect your information

We collect information:

Directly from you — when you contact us, book an appointment, register as a patient, complete a form or questionnaire, attend a consultation, or purchase products or services;
Automatically — when you visit our website, through cookies and analytics tools;
From others — such as referring physicians, laboratories and diagnostic partners, your insurer, or a parent or guardian acting on your behalf, where relevant to your care.

Health information is collected from you directly wherever possible, in line with DHA requirements.

4. How we use your information

We use your information to:

Provide, coordinate and follow up on your healthcare and pharmacy services;
Schedule appointments and respond to your enquiries and requests;
Prepare and dispense prescriptions and maintain accurate medical and pharmacy records;
Process payments and provide the documentation you need for insurance reimbursement;
Contact you about your appointments, results, treatment and care;
Meet our legal, regulatory and DHA obligations, including mandatory health information exchange and reporting;
Operate, secure, maintain and improve our website and services;
Where you have given consent, send you clinic news, health information, offers and updates (you can opt out at any time).

5. Legal basis for processing

We process your personal data on one or more of the following bases, as set out in the PDPL and the ICT Health Law: your consent; the necessity of processing to provide the healthcare services you request; compliance with our legal and regulatory obligations; and the protection of vital interests and the public interest in health, where applicable.

Where processing relies on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and remains subject to our legal obligation to retain certain medical records.

6. Health information exchange (NABIDH)

As a healthcare facility licensed by the Dubai Health Authority, we are required to connect to and exchange health information through NABIDH, the DHA’s unified health information platform, using a qualified electronic medical record (EMR) system. This allows authorised healthcare providers involved in your care to access relevant, up-to-date health information and supports safe, coordinated treatment. Information exchanged through NABIDH is governed by DHA regulations and UAE law.

7. Sharing your information

Your medical information is confidential. We share it only with those who need it to support your care, or where sharing is required or permitted by law. This may include:

The clinicians, practitioners and pharmacy staff directly involved in your care;
Laboratories, diagnostic centres and other healthcare providers to whom you are referred;
Your insurer or a third-party administrator, to arrange approvals and process claims (with your authorisation);
Regulatory and government authorities, including the DHA and the Ministry of Health and Prevention (MOHAP), where required by law or for public health and reporting obligations;
Trusted service providers who support our operations — such as IT, EMR and practice-management systems, appointment and communication platforms, and payment processors — who are bound by confidentiality and data-protection obligations and may only use your information to provide services to us;
Courts, law enforcement or other authorities where we are legally required to disclose.

We do not sell your personal or health information, and we do not share it for third-party marketing.

8. Data residency and international transfers

In accordance with the ICT Health Law, health information generated in the UAE is stored and processed on secure servers located within the United Arab Emirates. We do not transfer or store your health data outside the UAE except where permitted by law and with the required approvals. Where any limited transfer of non-health personal data outside the UAE is necessary (for example, certain website or communication tools), we take steps to ensure an adequate level of protection consistent with the PDPL.

9. Website chat, messaging and digital tools

Our website and communication channels (such as WhatsApp or online chat) may use automated or assisted tools to help answer general questions and direct your enquiry to the right team. Any general health information provided through these channels is for information only and is not a substitute for professional medical advice, diagnosis or treatment. Please do not share sensitive medical details through public or unsecured channels; our team will guide you to a secure method where needed.

10. Cookies and analytics

Our website uses cookies and similar technologies to help the site function, remember your preferences, and understand how visitors use the site so we can improve it. You can control or disable cookies through your browser settings; disabling some cookies may affect how the website works. [If you use a cookie consent banner or preference tool, describe it here.]

11. How we protect your information

We apply appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration or loss. These include restricted, role-based access so that staff see only the information relevant to their role, secure authentication for clinical systems, and monitoring in line with DHA digital-health security expectations. While we work hard to safeguard your information, no system can be guaranteed completely secure; please keep any patient-portal or account credentials confidential and contact us immediately if you suspect unauthorised access.

12. How long we keep your information

We keep your information only for as long as necessary for the purposes described in this policy and to meet our legal and regulatory obligations. Medical and pharmacy records are retained for the minimum periods required by the DHA and applicable UAE law. When information is no longer required, it is securely deleted or anonymised.

13. Your rights

Subject to UAE law and mandatory medical-retention requirements, you have the right to:

Access the personal information we hold about you and request a copy;
Request correction of inaccurate or incomplete information;
Request restriction of, or object to, certain processing;
Withdraw consent where processing is based on consent;
Request deletion of your information, where this does not conflict with statutory medical-retention obligations;
Lodge a complaint with us or with the competent authority.

To exercise any of these rights, please contact us using the details below. We may need to verify your identity before responding.

14. Children’s privacy

Where we provide services to minors, we do so with the consent and involvement of a parent or legal guardian, and we handle children’s information with particular care in line with UAE law and DHA requirements.

15. Marketing communications

We will only send you marketing communications where you have agreed to receive them. Every marketing message includes a way to opt out, and you can ask us to stop at any time by contacting us. Opting out of marketing does not affect communications relating to your care.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. The latest version will always be available on this page, with the “Last updated” date shown at the top. Where changes are significant, we will communicate them as appropriate.