Privacy policy

Who we are

medicAI is run by TechSphere Solutions Limited, a company registered in the Dubai International Financial Centre (DIFC), licence CL8452, at IH01-001, Innovation One, DIFC, Dubai, United Arab Emirates. In this policy, "medicAI", "we" and "us" mean that company.

We are a technology platform. We connect you with independent facilities licensed by the Dubai Health Authority (DHA) or the Department of Health Abu Dhabi (DoH). We do not treat patients, prescribe medicines, sell insurance or decide claims.

Because we are a DIFC company, the DIFC Data Protection Law, DIFC Law No. 5 of 2020 applies to how we handle personal data. Health information in the UAE is also covered by Federal Law No. 2 of 2019 on the use of information and communication technology in health fields, and by DHA and DoH rules.

For anything about data protection, email support@medicai.ae with the subject line "Data protection".

Who is responsible for your data

Several organisations may handle your data, and each is responsible for its own part. The law calls the organisation that decides why and how data is used the "controller", and an organisation that handles data on another's instructions the "processor".

Where your clinical record is. The facility that treats you holds your official clinical record. medicAI also holds information about your care, such as consultation details, prescriptions, lab reports, medical history and documents you upload, so that you and the people treating you can see them in the app. You can contact us or the facility about this information.

The data we collect

Data you give us or create by using medicAI

• Account and identity: name, date of birth, gender, phone number, email, password or Google or Apple sign-in, profile photo, language, and Emirates ID or passport details and scans where needed to verify you.
• Family members: details of dependants you or your employer add.
• Health data: symptoms you tell us about, consultation details, diagnoses, prescriptions, lab orders and reports, medical history, documents you upload, medication reminders, daily check-ins, mood logs and your health score.
• Wearable data: daily activity, sleep and body readings, only if you connect a device or health app.
• Bookings and orders: doctor, facility, service, date, delivery address, cancellations and reasons.
• Payment: amounts, status and receipts. You enter card details on the hosted page of our payment provider, Stripe, and we do not receive your full card number.
• Cover: employer, insurer, policy and benefit details.
• Location: your approximate or precise location, if you allow it, to find nearby providers and pharmacies and to arrange home visits and delivery. On Hajj and Umrah group programmes, location may also be used for safety features.
• Messages: what you send to support or through contact and partner forms, and your chat with the Nour assistant while the chat is open.
• Consent records: the form you accepted, your signature if you drew one, the date and time, your device details and IP address.

Data we get from others

• Facilities, doctors, labs and pharmacies: what they add about your care, such as notes, prescriptions and results.
• Your employer: the staff list used to enrol you, which can include your name, contact details, staff number and Emirates ID.
• Insurers and claims administrators: cover and approval information.
• A parent or guardian: details of a child or other dependant.
• Sign-in and device providers: basic profile details from Google or Apple, and wearable data through our connection provider, Terra, if you connect a device.

Data collected automatically

Device type, app version, IP address, pages visited, and logs of sign-ins, messages sent and important actions. See cookies and analytics.

Why we use your data and our legal reasons

The law requires a lawful basis for each use (Article 10 of the DIFC Data Protection Law). Health data also needs one of the extra conditions in Article 11.

We do not sell your personal data. Where we rely on legitimate interests, you can object. See your rights.

Health data and explicit consent

Health data has extra protection in law. We ask for your explicit consent separately from our terms of use, for each purpose, and you can say no to any purpose that care does not depend on. The legal terms and acceptance page lists every consent and what happens if you withdraw it.

Before a video consultation, you are asked for telehealth consent, following the DHA Guidelines for Patient Consent. This form records what the service involves, its limits and risks, and who is treating you. The treating doctor and facility remain responsible for making sure your consent is informed.

Health rules allow some sharing without your consent. Examples are insurer audit and approval, research using de-identified data, public health duties, court orders, and requests from DHA or another health authority. We share only what is required.

Health information exchanges. Licensed facilities may have to share records with the DHA exchange, NABIDH, in Dubai or with Malaffi in Abu Dhabi. That sharing is run by the facility and the health authority, not by medicAI. Ask your facility about the options available to you. In Dubai, you can also write to Nabidh.optout@dha.gov.ae.

Access to your records and continuity of care

You have a right to see your own health information and to keep your care going if you change provider. Subject to the law:

• You can see information about your care in the app, where the feature is available, and you can ask for a copy.
• You can ask for your records to be sent to another provider of your choice. We will do what is within our control and help you reach the treating facility for the official record.
• If you move to a new provider, we can help provide a copy or summary of your history and treatment plan, and help the two providers communicate, so your care is not interrupted.
• We work with facilities to keep information accurate. If something is wrong, tell us or the facility. The facility decides on clinical content, and DHA rules set a short deadline for facilities to deal with correction requests.
• We keep records for as long as the law requires. See the data retention policy.
• We review this section at least once a year.

What your employer and insurer can see

If your employer or insurer pays for your care, some information goes to them. Here is exactly what.

Your employer

• It can see who is enrolled, and group reports on usage and health trends. These include counts by broad condition category, such as mental health, and trends by age.
• It can also see lists that use a coded alias instead of your name. These can show your broad condition categories, whether they are getting worse, and how many consultations, lab orders and pharmacy orders the alias had.
• It cannot see your name beside a diagnosis, or your consultation notes, prescriptions, medicines or lab results.

A coded alias is not the same as being anonymous. In a small team, someone could work out who an alias is from age, department or how often they use the service.

Your insurer or claims administrator

Your insurer receives what it needs to approve and pay for your care under your policy, usually from the treating facility. We also prepare usage reports for invoicing, showing your name, email and how many consultations, pharmacy orders and lab orders you had, with no clinical details.

Children and dependants

You must be 18 or over to create your own medicAI account. UAE health rules treat anyone under 18 as a minor, so care for a child needs consent from a parent or legal guardian.

A parent or guardian can add a child as a dependant and use the service on their behalf. By doing so, they confirm they have the legal authority to do so. We do not knowingly let a child under 18 sign up alone. If you think that has happened, tell us and we will review it.

If you add another adult as a dependant, you must have their permission or legal authority to act for them. A dependant who turns 18 takes control of their own consents and can ask for their own account.

Who receives your data

• The people treating you: the doctors, facilities, labs and pharmacies you choose or are referred to.
• Your employer and insurer: only as described above.
• A parent, guardian or person you authorise.
• Delivery and home visit staff: your name, address and phone number, to reach you.
• Service providers working for us, listed below, under contract.
• Authorities and courts: DHA, DoH, the DIFC Commissioner of Data Protection, courts and others, where the law requires it.
• A buyer or successor, if our business is sold or restructured, under the same protections.

Where your data is held and international transfers

At the date of this policy, our main servers and database are in India (Mumbai) and uploaded files are stored in the United States. Other providers in the table above also handle data outside the UAE.

UAE health law restricts storing or sending health information outside the UAE. It is allowed only in the cases set out in Ministerial Decision No. 51 of 2021 or with approval from the health authority. Some of those cases need your written consent, or a copy kept in the UAE.

The DIFC Data Protection Law also treats any transfer outside the DIFC as an international transfer, including to a facility elsewhere in the UAE. We rely on one of these safeguards:

• A decision by the DIFC Commissioner that the destination has adequate protection.
• Standard data protection clauses issued by the Commissioner, signed with the recipient.
• A transfer needed to perform your contract with us, or a contract made in your interest, such as sending your booking to the facility you chose.
• Your explicit consent, after we have told you the risks.

You can ask us for details of the safeguard used for your data. See how to contact us.

How we protect your data

We use technical and organisational measures, including encrypted connections, hashed passwords, encryption of identity documents, role-based access and activity logs. No online service is completely secure. If a breach is likely to put you at high risk, we will tell you as soon as practicable. Read the full security policy.

How long we keep your data

We keep data only for as long as needed for the purpose or as required by law. Health records must be kept for at least 25 years from your last health procedure or encounter. Other data is kept for shorter periods. The data retention policy has the full table.

If you delete your account, we close it and remove it from normal use. Health records that the law requires us to keep are not erased until their retention period ends. They are put beyond normal use in the meantime.

Your rights

Under the DIFC Data Protection Law, you have these rights:

• Withdraw consent at any time, without giving a reason. This does not affect what was lawfully done before.
• See your data and get a copy.
• Correct data that is wrong or incomplete.
• Erase your data, unless the law requires us to keep it or we need it for a legal claim. Health records usually fall under this exception.
• Object to our use of your data based on legitimate interests. You can object to direct marketing at any time and we must stop.
• Restrict our use of your data while a question is being resolved.
• Move data you gave us to you or another organisation, in a common electronic format, where technically possible.
• Ask a person to review a decision made only by automated means that seriously affects you.
• Be told about changes: we tell those who received your data about corrections, erasure or restriction, where possible.
• Not be treated worse for using your rights.

How to use your rights

1. Email support@medicai.ae with the subject line "Data protection request", or call +971 56 991 1993. You can also use our contact form. You do not need an account.
2. We may ask you to prove who you are, to protect your data.
3. We reply within one month. If the request is complex, we may take up to two more months, and we will tell you why within the first month.
4. It is free. If a request is plainly unfounded or excessive, we may charge a reasonable fee or refuse, and we will explain why.

For the official clinical record, we may direct you to the facility or pass your request on, because the facility is responsible for it. Your insurer and employer deal with requests about the data they hold.

Complaints

Please talk to us first, using the contact details below. We want to put things right.

You can complain at any time to the DIFC Commissioner of Data Protection. You may also be able to apply to the DIFC Courts and claim compensation.

If your complaint is about care or a facility's handling of your record, you can also go to the health authority that licenses it: the Dubai Health Authority or the Department of Health Abu Dhabi.

Cookies and analytics

Cookies and similar tools store or read small pieces of information on your device. We use these:

Analytics and chat load when you open the website, including on signed-in pages. You can block or delete cookies at any time in your browser settings.

We do not set these tools up to receive your health details, and we do not use cookies for advertising on our signed-in pages.

AI and automated features

Nour, the health assistant

Nour is an AI chat assistant in the app. It answers general health questions and suggests a next step, such as a video consultation, a lab test, a pharmacy or emergency care. It is not a doctor. It does not diagnose or prescribe, and its answers can be wrong. If you think it is an emergency, call 998.

• What is sent: the messages in your chat, up to the last 20, go to Anthropic, the company that provides the AI model, outside the UAE. We do not attach your name or account details, but anything you type is sent, so avoid including your name, ID number or other identifying details.
• What is kept: we do not save your chat on our servers. It ends when you leave. Errors may be logged.
• Your choice: using Nour is optional, and you can get care without it. If you start a chat, your messages are sent as described here. Anthropic handles them under its own terms.

Other automated features

• Symptom categories: fixed rules sort the symptoms you enter to suggest a type of care. This supports a clinician and is not a diagnosis.
• Health score and employer reports: calculated using fixed rules, not by sending your details to an outside AI model.
• Our own staff tools: an internal assistant helps our staff, and it is set up to remove details like email addresses, phone numbers and ID numbers before anything is sent to the AI provider.

No AI decides your diagnosis, your treatment, your insurance cover or your claim. Licensed professionals and your insurer make those decisions.

We do not use your identifiable health data to train AI models. If this ever changes, we will ask for your separate consent first.

Changes to this policy

We will update this policy when our services or the law change, and we show the date at the top of the page. If a change is significant, we will tell you in the app or by email before it takes effect. If a new use of your data needs your consent, we will ask for it first. See legal terms and acceptance.

Contact us

• Email: support@medicai.ae, with the subject line "Data protection"
• Phone: +971 56 991 1993
• Web: our contact form
• Post: TechSphere Solutions Limited, IH01-001, Innovation One, DIFC, Dubai, United Arab Emirates