Privacy Policy

Effective Date: 1 January 2026 | Last Reviewed: 1 January 2026

This Privacy Policy describes how dmcmedical.ae (“we”, “us”, “our”) collects, uses, stores, discloses, and protects your personal data when you use domain.com. This policy is governed by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL), its Executive Regulations, MoHAP health data governance guidelines, and all applicable UAE laws in force as of January 2026.

1. Data Controller

dmcmedical.ae is the Data Controller for all personal data collected through domain.com. Our designated Data Protection contact can be reached at privacy@dmcmedical.ae or via the Contact Us page.

2. Personal Data We Collect

3. a) Identity & Contact Data

• Full name, Emirates ID number, date of birth, gender, and nationality.
• Email address, mobile number, billing address, and delivery address.

Health data is classified as Sensitive Personal Data under UAE PDPL and is subject to heightened protection.

1. c) Transaction Data

• Order history, payment method type, and transaction references.
• No card details are stored on our servers. All payment processing is handled by PCI-DSS compliant with third-party payment gateways.

1. d) Technical & Usage Data

• IP address, browser type, device identifiers, and operating system.
• Pages visited, session duration, click behavior, and navigation patterns collected via cookies and analytics tools.

3. Legal Basis for Processing

We process your personal data on the following legal grounds as defined under UAE PDPL:

• Performance of a contract — to fulfil your orders, process payments, and deliver services.
• Legitimate interests — to improve our services, detect and prevent fraud, and ensure platform and patient safety.
• Consent — for marketing communications and non-essential cookies. You may withdraw consent at any time.

4. How We Use Your Data

We use your personal data to:

• Process, dispense, and deliver your orders in compliance with UAE law.
• Send order confirmations, delivery updates, and transactional notifications.
• Send promotional and health communications where you have provided explicit opt-in consent.
• Improve our Platform, personalize your experience, and conduct internal analytics.
• Detect, prevent, and investigate fraudulent activity or misuse of the Platform.
• Comply with UAE regulatory reporting obligations to MoHAP, DHA, DoH, or law enforcement when legally required.

5. Sharing of Personal Data

We do not sell, rent, or trade your personal data. We may share your data with the following categories of recipients under strict confidentiality obligations:

• Last-mile delivery and logistics partners, for the purpose of order fulfilment only.
• PCI-DSS compliant payment processing providers.
• UAE regulatory authorities (MoHAP, DHA, DoH, UAE Police, Public Prosecution) where required or mandated by law.
• IT infrastructure, cloud hosting, and platform service providers, under binding data processing agreements.

All third parties who receive your data are contractually required to process it only for the specified purpose and in accordance with UAE PDPL.

6. Health Data — Special Category Protections

As Sensitive Personal Data under UAE PDPL, your health and medical information receive the following additional protections:

• Encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256.
• Retained for a minimum of 5 years as mandated by MoHAP prescription record-keeping regulations.
• Never used for advertising, profiling, or sharing with commercial third parties.

7. Data Retention

We retain personal data for the minimum period necessary to fulfil the purposes outlined in this policy or as required by UAE law:

• Prescription and dispensing records: Minimum 5 years (MoHAP mandate).
• Transaction and order records: 5 years (UAE VAT and commercial law requirements).
• General customer account data: 3 years from the date of last interaction.
• Marketing consent records: Until consent is withdrawn.

Upon expiry of the retention period, data is securely deleted or anonymized.

8. Your Rights Under UAE PDPL

Subject to the provisions of UAE Federal Decree-Law No. 45 of 2021, you have the following rights:

• Right to Access — Request a copy of the personal data we hold about you.
• Right to Rectification — Request correction of inaccurate or incomplete data.
• Right to Erasure — Request deletion of your data where we have no overriding legal obligation to retain it.
• Right to Restriction — Request that we limit the processing of your data in certain circumstances.
• Right to Object — Object processing based on legitimate interests.
• Right to Data Portability — Request a copy of your data in a structured, machine-readable format.
• Right to Withdraw Consent — Withdraw marketing or cookie consent at any time.

To exercise any of these rights, submit a written request to privacy@dmcmedical.ae or via the Contact Us page. We will acknowledge your request within 5 business days and respond within 30 calendar days.

9. Cookies & Tracking Technologies

dmcmedical.ae uses cookies, web beacons, and similar tracking technologies to enhance your experience, analyze traffic patterns, and deliver relevant content. You may manage your cookie preferences via the cookie consent banner displayed on your first visit, or through your browser settings.

Disabling non-essential cookies will not affect your ability to place orders or use core services.

10. Data Security

We implement appropriate technical and organizational security measures to protect your personal data, including:

• TLS 1.2+ encryption for all data in transit.
• AES-256 encryption for data at rest.
• Role-based access controls limiting data access to authorized personnel only.
• Regular security assessments, vulnerability scanning, and penetration testing.
• Staff training on UAE PDPL obligations and data handling procedures.

11. Cross-Border Data Transfers

Your personal data is processed and stored in the UAE. If any cross-border data transfer becomes operationally necessary, it will only be conducted to jurisdictions with adequate data protection laws or under appropriate contractual safeguards (Standard Contractual Clauses or equivalent), in compliance with UAE PDPL Article 22 requirements.

12. Children’s Privacy

This Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors without verified parental or guardian consent. If you are a parent or guardian and believe your child’s data has been collected, please contact privacy@dmcmedical.ae immediately and we will take prompt action.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable UAE law. The updated policy will be published on domain.com with a revised effective date. We encourage you to review this policy periodically.

14. Contact & Complaints

For privacy-related enquiries, data subject requests, or concerns, contact our Data Protection Officer at privacy@dmcmedical.ae.

If you believe we have not adequately addressed your privacy concern, you have the right to file a complaint with the UAE Data Office or the relevant supervisory authority under the UAE PDPL.