1 Scope of This Policy

This Privacy Policy applies to personal data collected by White Lily Medical Center through in-person visits, phone calls, WhatsApp conversations, online forms, appointment requests, email communication, and website usage.

It covers both patient information and visitor information where applicable, including information submitted for inquiries, consultations, bookings, follow-ups, insurance coordination, and customer support.

2 Information We Collect

Depending on how you interact with us, we may collect different categories of information to provide medical, administrative, and support services effectively.

• Identity and Contact Information: such as your full name, phone number, email address, date of birth, nationality, Emirates ID or passport details when required, and other contact details provided by you.
• Medical Information: including health history, symptoms, diagnosis details, treatment records, prescriptions, scans, x-rays, dental images, clinical notes, laboratory results, and follow-up information relevant to your care.
• Insurance and Billing Information: such as insurer name, insurance card details, approval references, claim-related data, invoices, receipts, and payment records.
• Communication Data: records of your messages, emails, call logs, appointment requests, confirmations, reminders, and customer support interactions.
• Technical and Website Data: such as IP address, browser type, device information, cookies, analytics data, and user interactions with our website, where such tools are enabled.

3 How We Use Your Information

We use your personal information only where necessary for legitimate operational, medical, legal, and service-related purposes.

• To schedule, confirm, manage, and follow up on appointments and treatment plans.
• To provide healthcare services, consultation support, diagnosis, treatment, and patient aftercare.
• To communicate with you regarding inquiries, reminders, updates, results, and clinic services.
• To coordinate with insurance providers and process approvals or claims where required.
• To maintain internal records, improve service quality, enhance safety, and support operational efficiency.
• To comply with legal, healthcare, licensing, and regulatory obligations in the United Arab Emirates.

4 Legal Grounds for Processing

We process personal information based on one or more lawful grounds, depending on the nature of the service and the information involved.

• Consent: where your consent is required, especially for certain health-related or optional communication activities.
• Provision of Services: where processing is necessary to deliver healthcare services, appointment handling, and related support.
• Legal and Regulatory Obligations: where we must comply with healthcare, billing, recordkeeping, and licensing requirements.
• Legitimate Interests: where processing is reasonably necessary for quality assurance, internal administration, fraud prevention, security, or service improvement, provided your rights are respected.

5 Sharing and Disclosure of Information

We do not sell your personal information. We only share information where it is necessary, appropriate, and limited to the relevant purpose.

• With authorized doctors, dentists, nurses, and medical staff involved in your care.
• With laboratories, imaging partners, or external medical service providers where necessary for treatment or diagnosis.
• With insurance companies, administrators, or claims processors for coverage verification and claim handling.
• With approved technology and operational service providers who support hosting, communication systems, booking tools, or website functions under confidentiality obligations.
• With regulators, public authorities, or legal bodies when disclosure is required by applicable law or official request.

6 Cross-Border Processing

Some of our systems, software providers, or communication platforms may process or store certain information outside the UAE. Where this occurs, we take reasonable steps to ensure that appropriate safeguards, protections, and contractual obligations are in place.

7 Data Retention

We retain personal and medical information only for as long as necessary to provide care, maintain proper clinical records, support legal and financial processes, and comply with applicable laws and health regulations.

Once retention is no longer required, information may be securely deleted, archived, or anonymized as appropriate.

8 Data Security

We implement administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, disclosure, or alteration.

• Controlled access to internal systems and records.
• Reasonable security practices for devices, communication tools, and patient files.
• Restricted access to sensitive information on a need-to-know basis.
• Ongoing review of operational and technical protection measures where appropriate.

9 Your Rights

Subject to applicable law and regulatory requirements, you may have the right to request access to your personal information, request correction of inaccurate details, object to certain processing activities, withdraw consent where relevant, and request deletion of data that is not required to be retained.

We may need to verify your identity before processing certain requests, and some requests may be limited by medical, legal, insurance, or regulatory obligations.

10 Cookies and Analytics

Our website may use cookies and analytics technologies to improve website performance, understand user behavior, measure campaign effectiveness, and enhance your browsing experience.

• Essential Cookies: help basic website functionality operate properly.
• Analytics Cookies: help us understand page visits, user behavior, and general site performance.
• Marketing Technologies: may be used where enabled for advertising measurement and audience insights.

You may manage cookie preferences through your browser settings or any consent mechanism made available on the website.

11 Children’s Privacy

For minors, personal and medical information should be provided and managed by a parent, guardian, or legally authorized representative, in accordance with applicable requirements. Where consent is required for treatment or data handling, it must be provided by the appropriate responsible party.

12 Marketing Communications

Where permitted, we may send service-related updates, clinic announcements, or promotional communications through approved channels. You may opt out of non-essential marketing communications at any time by contacting us or following the instructions in the communication where available.

13 Contact and Privacy Requests

If you have any questions regarding this Privacy Policy, or if you would like to request access, correction, or another privacy-related action, you may contact White Lily Medical Center through the channels below.