What we collect, why, and your rights over it

We try to collect as little as possible. The categories of personal data we hold:

• Email address when you submit one of our forms (newsletter signup, “notify me when bookings launch”, future quiz). We capture the email itself plus a tag noting which form it came from (e.g. “newsletter:homepage”).
• Server logs generated automatically when you visit the site - IP address, browser user-agent, the page you visited, and a timestamp. These are kept by our hosting provider for operational purposes (security, debugging, basic traffic patterns).
• Analytics - we currently do NOT run Google Analytics, Microsoft Clarity, or any other third-party tracking on cliniclick.ae. If we add any in future, this policy will be updated and the relevant cookies disclosed before the tools go live.

We do not collect: payment data, government-issued ID, location beyond what your IP reveals, anything from social networks, or any “sensitive personal data” categories under UAE PDPA (health data, biometrics, religious or political views).

• Email - to send you the newsletter and updates you signed up for, and to notify you when the directory and booking features launch. Lawful basis under UAE PDPA: your consent (you submitted the form).
• Server logs - to keep the site running (security, error diagnosis, abuse prevention, basic traffic analysis). Lawful basis: legitimate interest in operating a working website.

We use a small number of trusted third-party service providers to operate the site (hosting, email delivery, domain infrastructure). Each receives only the minimum data needed to do its job, and each is contractually bound to handle your data securely and only on our instructions.

We do not sell your data, share it with clinics, or pass it to advertising networks. None of our content placements are paid - we have no commercial reason to share visitor lists.

• Email subscribers - until you unsubscribe (every email has a one-click unsubscribe link) or you ask us to delete your record.
• Server logs - kept by our hosting provider for up to 30 days, then automatically purged.
• Unsubscribed records - we retain a hashed marker so we know not to add you back, but the original email address is removed.

Under UAE PDPA (Federal Decree-Law No. 45 of 2021) and equivalent regulations in other regions, you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate
• Delete your data (“right to be forgotten”)
• Object to processing for marketing purposes (one-click unsubscribe in every email)
• Data portability - receive a copy of your data in a common format
• Withdraw consent at any time, with no penalty

To exercise any of these, email support@cliniclick.ae. We aim to respond within 7 days and complete deletions within 30 days. There is no charge.

We do not currently set any first-party cookies on cliniclick.ae. Our hosting provider (Vercel) may set short-lived session cookies for security and load balancing - these are essential for the site to work and do not track you across other websites.

If we add analytics (Google Analytics, Microsoft Clarity, or similar) in future, this section will be updated to disclose the cookies set, what they collect, and how to opt out, before the tools go live.

If you are visiting from the EU, UK, or another region with stricter data-protection laws than the UAE, the GDPR and your local equivalents apply to your data. The rights and protections in this policy meet or exceed those requirements.

Some of our service providers operate from outside the UAE. By using cliniclick.ae you consent to your data being processed in those locations under appropriate cross-border safeguards.

If we change this policy in any material way, we will update the “Last updated” date at the top and email subscribers a summary of what changed. Minor wording corrections are made silently.

For any question about this policy or your data: support@cliniclick.ae.

If you believe we have violated UAE data-protection law and we have not resolved your complaint, you can escalate to the UAE Data Office (the federal regulator under PDPA).