Privacy Policy

1. Who we are

For privacy-related requests, you may contact us at: apearlskin@gmail.com

Pearl Skin Poly Clinic L.L.C. acts as the data controller for the personal data collected through this website, clinic systems and communication channels....

Pearl Skin Poly Clinic L.L.C. is a healthcare facility licensed by the Dubai Health Authority (DHA Facility License No. 4770615).

2. What personal data we collect

We may collect and process the following categories of personal data.

2.1 Contact and identification data

This may include:

• full name;
• phone number;
• email address;
• preferred language;
• city or country of residence;
• social media username, if you contact us through social media;
• any other contact details you voluntarily provide.

2.2 Appointment and service data

This may include:

• requested treatment or service;
• preferred appointment date and time;
• booking history;
• consultation requests;
• communication history with our team;
• visit history;
• treatment preferences;
• gift certificate requests or purchases.

2.3 Health and medical information

When you request a consultation or receive services, we may collect health-related data, including:

• skin concerns;
• medical history relevant to treatment;
• allergies;
• contraindications;
• current medication information;
• pregnancy or breastfeeding status, where relevant;
• previous aesthetic or medical procedures;
• photos or videos of the treatment area, where necessary and subject to consent;
• treatment plans;
• consultation notes;
• clinical records;
• aftercare information.

Health and medical information is treated as confidential information and protected in accordance with applicable UAE data protection and healthcare requirements.

2.4 Payment and transaction data

This may include:

• invoice details;
• payment confirmation;
• gift certificate purchase information;
• refund or cancellation information;
• transaction records;
• accounting records.

We do not intentionally store full bank card details on our website unless such data is processed through a secure payment provider.

2.5 Website and technical data

When you use our website, we may collect technical information, including:

• IP address;
• browser type;
• device type;
• operating system;
• pages visited;
• time spent on the website;
• referral source;
• approximate location based on technical data;
• cookies and similar technologies;
• website interaction data.

3. How we collect personal data

We may collect personal data when you:

• visit our website;
• submit a form on our website;
• request an appointment;
• request a consultation;
• contact us by phone, WhatsApp, email or social media;
• purchase or request a gift certificate;
• visit our clinic;
• provide medical information during consultation;
• consent to photography or video recording;
• communicate with our doctors, specialists, administrators or support team;
• use our online communication or booking channels.

4. Why we use personal data

We use personal data for the purposes described below.

4.1 To provide medical and aesthetic services

This includes:

• booking appointments;
• confirming appointments;
• conducting consultations;
• assessing treatment suitability;
• preparing individual treatment plans;
• maintaining medical records;
• providing aftercare instructions;
• following up after treatment;
• ensuring patient safety;
• managing contraindications and treatment risks.

4.2 To communicate with you

We may use your contact details to:

• respond to enquiries;
• confirm, change or cancel appointments;
• send appointment reminders;
• provide information about requested services;
• answer questions through WhatsApp, phone, email or social media;
• send service-related updates;
• provide aftercare or follow-up information.

4.3 To manage payments, invoices and gift certificates

We may process your data to:

• issue invoices;
• confirm payments;
• process gift certificates;
• manage refunds, cancellations or rescheduling;
• keep accounting and financial records;
• comply with tax and reporting obligations.

4.4 To improve our website and services

We may use website and technical data to:

• improve website performance;
• understand how visitors use the website;
• improve service quality;
• improve patient experience;
• detect and prevent website misuse;
• protect the website and clinic systems from security threats.

4.5 For marketing, where permitted

We may use your contact details to send information about our services, offers, events, promotions or clinic updates only where we have a lawful basis to do so, including your consent where required.

You may opt out of marketing communications at any time.

5. Legal basis for processing personal data

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, where one or more of the following applies:

• you have given consent;
• processing is necessary to respond to your enquiry or appointment request;
• processing is necessary to provide requested services;
• processing is necessary for medical consultation, treatment or healthcare management;
• processing is necessary to maintain medical records;
• processing is necessary to comply with legal, regulatory, accounting, tax or healthcare obligations;
• processing is necessary to protect our legitimate business interests, provided that your rights and interests are respected;
• processing is necessary to protect vital interests or public interest, where applicable under UAE law.

6. Medical data and confidentiality

Medical and health-related information is treated as confidential.

Access to such information is limited to authorised personnel who need the information to provide care, manage appointments, maintain records, comply with healthcare requirements or support clinic operations.

This may include:

• licensed doctors;
• healthcare professionals;
• clinic administrators;
• authorised management staff;
• authorised IT or system support providers, where necessary.

We apply appropriate technical and organisational measures to protect health-related data against unauthorised access, loss, misuse, alteration or disclosure.

7. Photos, videos and before/after materials

We may take photos or videos for clinical documentation, treatment planning, progress monitoring and patient record purposes.

We will not use your photos, videos, testimonials, reviews or before/after images for website, social media, advertising, marketing or public educational purposes without your separate consent.

If you give consent for marketing use, you may withdraw that consent at any time by contacting us at: apearlskin@gmail.com

Withdrawal of consent will not affect any lawful use that occurred before the withdrawal.

8. Consultation requests and photo submissions (website chat)

Our website includes a chat assistant that allows you to submit a consultation request. When you use this feature, you may provide:

• your name;
• your phone number or WhatsApp number;
• a preferred appointment date or time;
• a description of your skin concern or treatment interest;
• an optional photo of the skin or treatment area.

This information is submitted only after you tick a consent checkbox confirming that you agree to share it with Pearl Skin Poly Clinic L.L.C. for the purpose of assessment and contact.

How this information is handled

When you submit the form, your details and any attached photo are sent directly to the clinic by email. The information is not stored in a database, on the website’s servers, or in any persistent storage connected to this website. Once delivered to the clinic’s email inbox, it is held only within that email system.

The email delivery service we use (Resend) processes the data solely in order to send the message. Their practices are governed by their own privacy policy.

Photos submitted via the chat are treated as health-related data. They are used only to help the clinic’s medical team prepare a personalised consultation plan and to respond to your enquiry.

If you have questions about any information you submitted via the chat, or wish to ask the clinic to delete it from their records, please contact us at: apearlskin@gmail.com

9. WhatsApp, phone, email and social media communication

If you contact us through WhatsApp, phone, email, Instagram, Facebook or other third-party platforms, your personal data may also be processed by those third-party providers according to their own privacy terms.

We may use these channels to:

• respond to enquiries;
• arrange appointments;
• send appointment reminders;
• provide service-related information;
• answer follow-up questions;
• share aftercare instructions;
• communicate about gift certificates or clinic services.

Please avoid sending highly sensitive medical information through public social media comments or unsecured channels.

10. Cookies and analytics

Our website uses cookies and similar technologies to:

• make the website function properly;
• remember preferences;
• measure website traffic;
• understand user behaviour;
• improve user experience;
• support marketing analytics, where applicable.

Cookies may collect technical data such as device type, browser, pages visited and interaction data.

We use Google Tag Manager and Google Analytics to measure traffic and understand how visitors use our site, and Google Maps to show our location. These technologies load automatically when you visit our website and may set cookies.

You can manage, disable or delete cookies at any time through your browser settings, and you can opt out of Google Analytics using Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout). Some website features may not work properly if cookies are disabled.

If we use analytics tools, advertising pixels or similar technologies, these tools may process technical and interaction data according to their own terms and privacy policies.

11. Sharing personal data

We may share personal data only where necessary and lawful.

This may include sharing data with:

• licensed healthcare professionals working with or for Pearl Skin Poly Clinic L.L.C.;
• clinic administrative staff;
• IT, website, hosting and CRM providers;
• communication service providers;
• booking system providers;
• payment and accounting providers;
• legal, accounting or professional advisers;
• regulatory authorities, where required by law;
• government or healthcare authorities, where legally required.

We do not sell personal data.

We do not share your medical information for marketing purposes without your consent.

12. International data transfers

Some service providers, communication tools, cloud systems, email services, analytics tools or software platforms may store or process data outside the United Arab Emirates.

Where personal data is transferred internationally, we take reasonable steps to ensure appropriate protection of such data in accordance with applicable UAE data protection requirements.

13. Data retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, including:

• providing services;
• maintaining medical records;
• managing appointments;
• complying with healthcare regulations;
• meeting legal, tax, accounting and reporting obligations;
• resolving disputes;
• protecting our rights and legitimate interests.

Medical records are retained for a minimum of ten (10) years in accordance with the requirements of the Dubai Health Authority and applicable UAE healthcare laws and regulations.

When personal data is no longer required, we will delete, anonymise or securely archive it.

14. Data security

We use appropriate technical and organisational measures to protect personal data, including:

• access controls;
• confidentiality obligations for staff;
• secure data storage;
• restricted access to medical records;
• internal procedures for handling personal data;
• reasonable administrative, technical and physical safeguards;
• security measures for clinic systems and digital communication channels.

No website, email system or digital communication channel can be guaranteed to be completely secure, but we take reasonable steps to protect your personal data.

15. Personal data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will take appropriate steps to address the breach and limit its impact.

Where required under Federal Decree-Law No. 45 of 2021 and its implementing regulations, we will notify the competent UAE authorities without undue delay after becoming aware of the breach.

Where the breach is likely to result in a high risk to your rights, we will also notify the affected individuals without undue delay, describing the nature of the breach and the measures taken to address it.

16. Your rights

Subject to applicable UAE law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data, where legally permitted;
• withdraw consent where processing is based on consent;
• object to certain processing activities;
• request restriction of processing in certain cases;
• request information about how your data is processed;
• request to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another party where technically feasible;
• opt out of marketing communications.

To exercise your rights, contact us at: apearlskin@gmail.com

We may need to verify your identity before responding to your request.

17. Marketing communications

We may send marketing messages about our services, offers, events or clinic updates only where permitted by law.

You can opt out at any time by:

• replying to the message;
• using an unsubscribe option, where available;
• contacting us at apearlskin@gmail.com.

Opting out of marketing does not affect service-related communications, such as appointment confirmations, appointment reminders, treatment follow-ups or aftercare messages.

18. Children’s data

Our services are intended for adults.

If services are requested for a person under the age of majority, we may require consent from a parent or legal guardian before collecting or processing personal data or providing treatment.

We do not knowingly collect personal data from children for marketing purposes without appropriate consent.

19. Third-party links and platforms

Our website may contain links to third-party websites, social media pages, maps, messaging platforms or booking tools.

We are not responsible for the privacy practices, content, security or data processing activities of third-party websites or platforms.

When you use third-party platforms, their own privacy policies and terms may apply.

20. Updates to this Privacy Policy

We may update this Privacy Policy from time to time.

The updated version will be published on this page with a new "Last updated" date.

Continued use of our website or services after publication of the updated Privacy Policy means that you have read the updated version.

21. Contact us

For questions about this Privacy Policy or the way we process personal data, contact us at:

For matters specifically relating to data protection and the processing of personal data, you may contact the person responsible for data protection at the clinic: