Privacy Policy

Who we are

DR NAMSHIS AESTHETIC MEDICINE AND DENTISTRY L.L.C S.O.C, trading as Dr. Namshi's Aesthetic Medicine & Dentistry ("we", "us"), a DHA-licensed clinic in Dubai, is responsible (the "controller") for the personal data described here. This policy covers this website, our WhatsApp and phone channels and our job applications. It is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"). Your medical records at the clinic are also protected by UAE health-data law (Federal Law No. 2 of 2019).

What we collect

• Appointment requests (website form): your name and phone number, and if you add them, your email, the treatment and doctor you are interested in, a preferred time and your message. We also record the page you sent it from, the site language and how you found us (for example "Instagram ad" or "Google search").
• WhatsApp, phone and email: the messages, voice notes, photos and files you send us, your WhatsApp name and number, and call details. When you open WhatsApp from our website, the first message is prefilled with the page you were on and a short reference code showing how you reached our site; you can edit or delete it before sending.
• Free AI Check: the one photo you take or upload and what you ask us to look at (see below).
• Job applications: your name, phone, email, the role, your CV and anything you tell us.
• Website use, only if you accept cookies: pages visited, clicks on our call / WhatsApp / booking buttons, device and browser type, approximate location from your IP address, and advertising cookie IDs (see "Cookies and tracking").

Why we use it, and our legal basis

• To answer your enquiry, arrange and confirm appointments and follow up (taking steps at your request before a service, and our legitimate interest in running the clinic).
• To provide and document your care once you are a patient (contract with you and our legal duties under UAE health law).
• To consider you for a job (steps at your request before an employment contract).
• To measure our website and advertising with Google Analytics and Meta (your consent, which you can withdraw at any time).
• To keep our systems secure and stop abuse such as spam form submissions (legitimate interest).

Health information (for example the treatment you ask about, or your photo in the AI Check) is sensitive data. We use it only to respond to you and care for you, never for advertising.

Free AI Check (photo analysis)

If you use the Free AI Check, your photo is sent over an encrypted connection to Google's Gemini API, which produces the educational result shown to you (and, for smiles, an illustrated "after" image). Our website does not store the photo or the result: they are processed in memory and discarded. Google processes the photo on our behalf under its Gemini API terms: on a paid account Google does not use it to improve its products, but it may keep it for up to 55 days to detect abuse. This processing takes place on Google's servers, which can be outside the UAE. The check is for adults aged 18 or over, is educational only and is not a medical diagnosis. Please do not upload photos of children. Our analytics only count how many people start and finish the check; your photo, your result and what you chose to look at are never sent to Google Analytics or Meta.

WhatsApp and AI-assisted replies

We use the WhatsApp Business Platform (Meta) to talk with you. Messages and contact details are kept in our clinic messaging system (the Iskaria console) so the team can answer you, confirm bookings and send reminders. Some messages may be processed by an AI service (Google Gemini) to help our team, for example to translate a message, summarise a conversation, suggest a reply or answer common questions automatically where that is switched on. A staff member remains responsible for your care, and you can always ask to speak to a person. Messages we send you more than 24 hours after your last message use templates approved by WhatsApp, and you can ask us at any time to stop sending you offers.

Who we share it with

We do not sell your personal data. We share it only with service providers that process it for us under contract, and with authorities when the law requires:

• Iskaria (our clinic messaging, booking and hiring system), hosted on Vercel and Upstash cloud servers.
• Meta Platforms (WhatsApp Business Platform; Meta Pixel and Conversions API if you accept cookies).
• Google (Gemini API for the AI Check and AI-assisted replies; Google Analytics if you accept cookies).
• Zoho (email inbox, team notifications and our customer list).
• Vercel (hosting of this website).

Some of these providers process data outside the UAE (for example in the European Union, the United States or India). Where that happens we rely on the transfer grounds allowed by the PDPL, such as the provider's contractual safeguards or your consent. Clinical records about your treatment are kept in the clinic's own systems.

How long we keep it

• Appointment requests and messages: for as long as needed to answer you and follow up. If you become a patient, your records are kept as UAE health law requires (at least 25 years after your last treatment).
• Job applications: for as long as they are relevant to recruitment. Ask us at any time and we delete them.
• AI Check photos: not stored by us (Google: up to 55 days, see above).
• Analytics and advertising data: according to Google's and Meta's retention settings for our accounts.

Security

Data is sent over encrypted connections and is accessible only to authorised clinic staff and our providers for the purposes above. Access to our systems is password- and permission-protected.

Your rights

Under the PDPL you can ask us to:

• give you a copy of the personal data we hold about you, and receive it in a usable format;
• correct or complete it;
• delete it, or restrict how we use it, where the law allows (we cannot delete medical records we must keep by law);
• stop using it for a purpose, including any marketing;
• withdraw your consent at any time (for cookies use "Cookie settings"); this does not affect what was done before.

Write to us using the details below; we answer within 30 days. If you are not satisfied, you can complain to the UAE Data Office.

Children

Our website and the AI Check are meant for adults. A parent or guardian should contact us for a child's appointment.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version.