Privacy Policy
Last updated: 26 July 2026
1. Who we are
Al-Zahra operates a preventive-health platform. This policy explains what personal data we collect, why, our legal basis, who we share it with, and your rights.
Controller: [legal entity], [address], UAE. Contact: info@alzahra.ai
2. The data we collect
Identity & contact: name, date of birth, sex, Emirates ID where required, phone, email, city/country, preferred language.
Health data: laboratory results and biomarkers, vitals, medications, medical history, questionnaire answers, clinician notes, risk scores, biological-age outputs, uploaded reports.
Device & wearable data you choose to connect.
Commerce: orders, membership tier, payment status — card details are handled by our payment provider, not stored by us.
Technical: device, browser, IP address, logs, cookies.
3. Why we process it
To provide the platform (unify records, compute risk scores, generate protocols and plans): performance of our contract with you and your consent for health data.
To enable your clinician to review and advise: your consent.
Safety, security and fraud prevention: legitimate interests and legal obligation.
To improve and validate our models using de-identified data: legitimate interests.
Marketing: your consent, withdrawable at any time.
4. Automated processing
The platform computes risk scores using published, guideline-based instruments and generates AI-assisted explanations and plans. These outputs are clinical decision-support and general health information — not a diagnosis, prescription or medical device output — and do not replace your doctor. You may request human review of any output that affects you.
5. Who we share data with
Clinicians, clinics and hospitals you grant access to.
Fulfilment partners (laboratories, pharmacies, clinics) for what you ordered.
Processors (hosting, analytics, payments, communications) under written data-processing agreements.
Authorities where legally required.
We do not sell your personal data, and we do not share data that identifies you with pharmaceutical manufacturers, insurers, employers or advertisers.
6. Aggregate population insights
Your data may contribute to aggregate, de-identified statistics shared with health authorities, payers, employers, research institutions and pharmaceutical manufacturers to improve preventive care.
This means group-level figures only, such as "X% of adults aged 45–60 in Dubai are on a given therapy class." What is shared is anonymous: it does not identify you and cannot be traced back to you.
Recipients never receive your name, contact details, Emirates ID, individual records or any identifier; never receive prescriber identity; and may not use insights to target or influence individual patients or doctors. Groups smaller than 11 individuals are suppressed so you cannot be re-identified.
You may object to this use at any time by contacting info@alzahra.ai, without losing access to any clinical feature.
7. International transfers
Data is hosted in [region]. Where transferred outside the UAE we apply appropriate safeguards.
8. Retention
We retain health records for the period required by UAE health-records law and other data for as long as your account is active plus [ ] months. Anonymous aggregates may be retained indefinitely as they no longer identify you.
9. Your rights
Access a copy of your data; correct it; request deletion; object to or restrict processing; withdraw consent without affecting prior lawful processing; request portability; and lodge a complaint with the UAE Data Office or the relevant health authority.
Contact info@alzahra.ai; we respond within 30 days.
10. Security, children and changes
Encryption in transit and at rest, role-based access control, row-level database security, audit logging and least-privilege access.
Not intended for under-18s without verified guardian consent.
We will notify you of material changes before they take effect and publish the version and date at the top of this page.
See also: Terms and Conditions