Book a treatment today to begin your wellness journey.
Privacy
Policy
The Elixir Clinic (“The Elixir Clinic”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information and health information entrusted to us.
This Privacy Policy explains how we collect, use, store, protect and disclose personal information when you interact with The Elixir Clinic, including when you visit one of our clinics, contact us, make an enquiry, book a consultation, receive treatment, visit our website or communicate with us through our official channels.
As a healthcare provider, we recognise that health and medical information is highly sensitive. We therefore handle health information confidentially and in accordance with applicable United Arab Emirates laws, regulations, healthcare requirements and professional obligations.
This Privacy Policy should be read together with any applicable consent forms, patient information notices, treatment documentation and other policies provided to you by The Elixir Clinic.
1. WHO WE ARE
This Privacy Policy applies to The Elixir Clinic and the services provided through our clinics and official communication channels.
Dubai Clinic
The Elixir Clinic Dubai
583 Jumeirah Street
Umm Suqeim 1
Dubai, United Arab Emirates
Abu Dhabi Clinic
The Elixir Clinic Abu Dhabi
Villa A04, Marina Village
Abu Dhabi, United Arab Emirates
General Contact
Website: www.theelixirclinic.com
Email: [email protected]
For clinic-specific matters, please indicate whether your enquiry relates to our Dubai or Abu Dhabi clinic.
2. OUR COMMITMENT TO PRIVACY
We are committed to protecting the confidentiality, integrity, availability and security of information entrusted to us.
We take appropriate administrative, technical and physical measures to protect personal and health information against unauthorised access, disclosure, loss, alteration, misuse, destruction or other unlawful processing.
Healthcare information is subject to specific UAE healthcare privacy and information-security requirements.
In Dubai, DHA requires healthcare entities to protect protected health information and maintain appropriate administrative, technical and physical safeguards. DHA’s current health-data framework also addresses access control, information sharing, data protection, incident management and confidentiality.
In Abu Dhabi, healthcare entities are subject to the Department of Health’s Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS V2) and the AAMEN healthcare information-security programme.
3. INFORMATION WE COLLECT
The information we collect depends on the services you use and your relationship with The Elixir Clinic.
3.1 Personal Information
This may include:
- Full name;
- Date of birth;
- Gender, where relevant;
- Nationality, where required;
- Emirates ID, passport or other identification information where required;
- Telephone number;
- Email address;
- Address or location information where required;
- Appointment information;
- Patient or client identification numbers;
- Information relating to your interactions with us; and
- Other information reasonably necessary to provide our services.
3.2 Health and Medical Information
Where necessary for providing healthcare and treatment, we may collect and process sensitive health information, including:
- Medical history;
- Current health conditions;
- Previous diagnoses;
- Allergies;
- Current and previous medication;
- Supplements;
- Pregnancy or breastfeeding status;
- Previous treatments and procedures;
- Treatment history;
- Consultation information;
- Clinical notes;
- Test results;
- Laboratory or diagnostic information;
- Treatment photographs or images where appropriate;
- Treatment plans;
- Prescribing information;
- Information regarding your response to treatment; and
- Other information reasonably necessary to assess and provide safe and appropriate care.
Health information is treated as confidential and is only accessed by authorised persons for legitimate healthcare, administrative, regulatory or legal purposes.
UAE healthcare legislation specifically requires health information to be kept confidential and protected against unauthorised access, damage, alteration, deletion and disclosure.
3.3 Financial and Transaction Information
We may process information relating to services and transactions, including:
- Treatments and services purchased;
- Invoices;
- Pro forma invoices;
- Deposits;
- Payment status;
- Refund information;
- Voucher information; and
- Transaction records.
Where payments are processed through a third-party payment provider, payment information may be processed by that provider under its own terms and privacy practices.
3.4 Communications
We may retain information contained in communications between you and The Elixir Clinic, including:
- Emails;
- Appointment communications;
- Enquiries;
- Complaints;
- Feedback;
- Treatment-related communications;
- Aftercare communications;
- Telephone communications where appropriate; and
- Communications through our official social media or messaging channels.
4. HOW WE COLLECT YOUR INFORMATION
We may collect information directly from you when you:
- Contact us;
- Make an enquiry;
- Request information;
- Book an appointment;
- Attend a consultation;
- Complete a medical or consultation form;
- Receive treatment;
- Purchase a service;
- Purchase or redeem a voucher;
- Purchase or participate in a package or membership;
- Contact us regarding a complaint;
- Communicate with us through our website, email, telephone or official channels; or
- Otherwise interact with The Elixir Clinic.
We may also receive information from other healthcare professionals, laboratories, pharmacies, insurers, authorised representatives or other organisations involved in your care where this is necessary and lawful.
5. WHY WE COLLECT AND USE YOUR INFORMATION
We may collect and use your information for the following purposes.
5.1 Providing Healthcare and Treatment
We use information to:
- Assess your medical history;
- Determine treatment suitability;
- Conduct consultations;
- Provide safe and appropriate care;
- Maintain clinical records;
- Develop treatment plans;
- Provide treatment;
- Provide aftercare and follow-up;
- Manage prescriptions and medication where applicable;
- Monitor treatment outcomes; and
- Communicate with you regarding your care.
5.2 Appointments
We may use your information to:
- Book appointments;
- Confirm appointments;
- Send appointment reminders;
- Manage cancellations;
- Manage no-shows;
- Manage deposits; and
- Rearrange appointments.
5.3 Administration
We may use information to:
- Maintain patient records;
- Prepare invoices and pro forma invoices;
- Process transactions;
- Manage accounts;
- Respond to enquiries;
- Handle complaints;
- Provide customer support; and
- Maintain appropriate business records.
5.4 Legal and Regulatory Requirements
We may process or disclose information where necessary to:
- Comply with applicable laws and regulations;
- Comply with DHA requirements;
- Comply with Department of Health – Abu Dhabi requirements;
- Meet healthcare reporting obligations;
- Respond to lawful requests from competent authorities;
- Protect patient safety;
- Prevent or investigate fraud or unlawful activity;
- Establish, exercise or defend legal claims; or
- Fulfil other legal or regulatory obligations.
Healthcare facilities may also be required to submit specified information to healthcare authorities and health information exchange systems in accordance with applicable requirements. For example, Abu Dhabi’s health information framework requires healthcare providers to participate in applicable health-information exchange and data standards.
6. HEALTHCARE DATA AND MEDICAL CONFIDENTIALITY
Your health information is confidential.
We restrict access to health information to authorised individuals who require access for legitimate purposes.
This may include healthcare professionals involved in your care and authorised staff responsible for clinical, administrative, technical, regulatory or legal functions.
We will only disclose confidential health information where there is an appropriate legal, clinical, regulatory or other lawful basis for doing so.
This may include disclosure:
- With your consent;
- To healthcare professionals involved in your care;
- Where necessary to provide healthcare;
- To an authorised healthcare information exchange;
- Where required by law or applicable regulation;
- Where required for mandatory healthcare reporting;
- Where necessary to protect your health or safety or the health or safety of another person; or
- Where otherwise permitted by applicable law.
Dubai’s health-information framework requires patient information to be treated as confidential and protected against loss, tampering, destruction and unauthorised or inadvertent disclosure.
7. HEALTH INFORMATION EXCHANGE
Where required by applicable healthcare regulations, The Elixir Clinic may be required to participate in authorised healthcare information-exchange systems.
Dubai
Where applicable, patient information may be processed through DHA-approved health-information systems, including NABIDH, in accordance with applicable DHA requirements.
DHA describes NABIDH as the electronic health-information system through which patient health information can be securely exchanged between participating healthcare providers.
Abu Dhabi
Where applicable, patient information may be processed through the Abu Dhabi Health Information Exchange, including Malaffi, in accordance with Department of Health requirements.
Malaffi connects healthcare providers in Abu Dhabi and facilitates secure access to relevant patient health information for healthcare purposes.
Such processing and sharing may occur because of applicable healthcare requirements and does not necessarily depend solely on individual marketing or website consent.
8. WHO WE MAY SHARE INFORMATION WITH
We may share personal or health information where necessary, appropriate and lawful with:
- Healthcare professionals involved in your care;
- Laboratories and diagnostic providers;
- Pharmacies and medication-related providers where applicable;
- Healthcare information-exchange platforms;
- Healthcare service providers;
- Insurance providers where applicable;
- Appointment and booking providers;
- Information technology and software providers;
- Payment service providers;
- Professional advisers;
- Legal advisers;
- Auditors;
- Govenment authorities;
- Healthcare regulators;
- Other authorised healthcare entities; and
- Service providers processing information on our behalf.
Where third parties process information for us, we will take appropriate steps to ensure that appropriate confidentiality, security and data-protection requirements apply.
We do not sell your personal or health information.
9. INTERNATIONAL TRANSFERS AND STORAGE
Health information is subject to specific UAE requirements concerning storage, processing and transfer outside the UAE.
Federal Law No. 2 of 2019 provides that health data relating to healthcare services provided in the UAE must not be stored, processed, generated or transferred outside the UAE except where the applicable legal and regulatory requirements and approvals permit this.
Accordingly, The Elixir Clinic will not intentionally transfer or store health information outside the UAE except where permitted under applicable UAE law and the relevant healthcare regulatory requirements.
Where applicable, we will implement appropriate safeguards, approvals, contractual requirements and security measures for any permitted transfer or processing.
Because the exact systems and third-party providers used by the clinic may change, the clinic’s internal data-processing arrangements must be maintained in accordance with the requirements applicable to the relevant branch and regulator.
10. DATA SECURITY
We maintain appropriate technical, administrative and physical safeguards designed to protect personal and health information.
These measures may include:
- Access controls;
- User authentication;
- Role-based access;
- Password controls;
- Secure systems;
- Encryption where appropriate;
- Secure transmission;
- Physical security;
- Staff confidentiality obligations;
- Staff training;
- Monitoring and auditing;
- Incident-management procedures;
- Data-backup procedures; and
- Secure disposal procedures.
Access to patient information is limited according to the individual’s role and legitimate need for access.
No electronic system or method of transmission can be guaranteed to be completely secure. However, we take appropriate measures to reduce the risks associated with unauthorised access, disclosure, loss or misuse.
11. DATA RETENTION
We retain personal and health information only for as long as reasonably necessary for the purposes for which it was collected and/or for as long as required by applicable healthcare, legal, regulatory, professional, accounting or other requirements.
Healthcare records may need to be retained for longer periods than ordinary administrative information.
The Elixir Clinic will retain and dispose of health records in accordance with the retention and destruction requirements applicable to the relevant clinic and regulator.
When information is no longer required and there is no legal or regulatory requirement to retain it, appropriate measures will be taken to securely delete, destroy or anonymise it.
DHA requirements specifically address the secure retention and destruction of health records.
12. ACCESS TO YOUR HEALTH RECORDS
Subject to applicable law and regulatory requirements, you may request access to your personal and health information held by The Elixir Clinic.
We will handle requests in accordance with the procedures and requirements applicable to the relevant clinic and regulator.
Access may be subject to appropriate identity verification and any legal or regulatory restrictions.
Where a request relates to a medical record, the clinic may require the request to be processed through the appropriate healthcare professional or medical-records process.
Dubai’s healthcare requirements recognise patients’ rights to access their medical records subject to the applicable procedures.
13. CORRECTION OF INFORMATION
If you believe that personal information we hold about you is inaccurate, incomplete or out of date, you may contact us and request that it be corrected.
Where appropriate, we will review the information and make corrections in accordance with applicable law and healthcare record requirements.
Clinical records may be subject to specific rules concerning amendment, audit trails and preservation of the original record. Information will therefore not necessarily be deleted or altered where doing so would conflict with applicable healthcare-record requirements.
14. YOUR DATA PROTECTION RIGHTS
Depending on the applicable law and circumstances, you may have rights including:
- The right to request access to personal information;
- The right to request correction of inaccurate information;
- The right to request information about how your information is processed;
- The right to request restriction of certain processing;
- The right to object to certain processing;
- The right to withdraw consent where processing is based on consent;
- The right to request deletion where legally applicable; and
- Other rights provided by applicable UAE law.
These rights are not absolute.
For example, The Elixir Clinic may be required to retain medical records or process health information to comply with healthcare legislation, regulatory requirements, public-health obligations or other legal requirements.
The UAE Personal Data Protection Law provides a framework governing personal-data processing and recognises various data-subject rights, while personal health data is subject to separate healthcare legislation where applicable.
15. WITHDRAWING CONSENT
Where we rely on your consent to process information, you may withdraw your consent by contacting us.
Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
Withdrawal of consent may also not prevent us from continuing to process information where another lawful basis applies or where processing is required by healthcare, legal or regulatory requirements.
For example, withdrawing consent for marketing communications will not prevent us from processing information necessary to provide your healthcare or manage your appointments.
16. MARKETING
Where permitted by applicable law, we may contact you regarding:
- The Elixir Clinic services;
- New services;
- Offers;
- Promotions;
- Events; and
- Other clinic-related information.
Where consent is required for marketing, we will obtain the appropriate consent.
You may opt out of marketing communications at any time.
Opting out of marketing will not prevent us from sending essential communications relating to your care, including appointment confirmations, treatment information, invoices, aftercare or other service-related communications.
17. PHOTOGRAPHS AND TREATMENT IMAGES
Where photographs or images are taken as part of your consultation or treatment, they may form part of your clinical or treatment record.
Such images will be treated as confidential health information where applicable.
We will not use identifiable patient photographs, videos or treatment images for advertising, social media, marketing or promotional purposes without the appropriate consent or other lawful basis where required.
Separate consent may be requested where The Elixir Clinic wishes to use a patient’s image for marketing or promotional purposes.
18. SOCIAL MEDIA, WHATSAPP AND OTHER COMMUNICATION CHANNELS
The Elixir Clinic may use official social media, WhatsApp, email, telephone and other communication platforms for administrative and service-related communications.
These platforms may be operated by third parties and may be subject to their own terms and privacy policies.
For your protection, you should avoid sending highly sensitive medical information through social media direct messages or other channels that have not been designated by The Elixir Clinic for secure clinical information.
Where appropriate, we may ask you to provide medical information through the clinic’s approved clinical or healthcare systems instead.
19. WEBSITE AND COOKIES
When you visit our website, certain technical information may be collected automatically.
This may include:
- IP address;
- Browser type;
- Device type;
- Operating system;
- Pages visited;
- Website activity;
- Approximate location information;
- Referring website; and
- Technical information required for website security and operation.
We may use cookies and similar technologies to:
- Operate our website;
- Improve functionality;
- Understand website usage;
- Improve user experience;
- Maintain security; and
- Support analytics or other website functions where applicable.
Where required by applicable law, consent will be obtained for non-essential cookies and similar technologies.
You may also control cookies through your browser settings.
20. THIRD-PARTY WEBSITES
Our website or official communication channels may contain links to third-party websites or services.
The Elixir Clinic is not responsible for the privacy practices, security or content of third-party websites.
We recommend reviewing the privacy policy of any third-party website before providing personal information.
21. CHILDREN AND YOUNG PEOPLE
We take the privacy and confidentiality of children and young people seriously.
Where services are provided to a minor, information will be handled in accordance with applicable healthcare, consent, safeguarding and data-protection requirements.
Where appropriate and lawful, information may be provided to or obtained from a parent, guardian or legally authorised representative.
The rights and confidentiality of the minor will be considered in accordance with applicable law and professional requirements.
22. DATA BREACHES AND SECURITY INCIDENTS
The Elixir Clinic maintains procedures for identifying, containing, investigating and responding to personal-data and health-data security incidents.
If a breach occurs, we will assess the nature and severity of the incident and take appropriate corrective and preventative action.
Where notification is required, we will notify the relevant regulator and/or affected individuals within the applicable regulatory timeframe.
Dubai
DHA’s health-data framework contains specific requirements concerning the management and reporting of health-information breaches, including notification where a breach is likely to create a high risk to the privacy or confidentiality of the affected individual.
Abu Dhabi
ADHICS V2 requires healthcare entities to detect, report, investigate and manage health-information breaches. Where a breach is likely to result in high risk to affected data subjects, the entity must notify the affected individuals as required by the applicable standard.
23. DATA PROTECTION RESPONSIBILITIES
The Elixir Clinic maintains appropriate internal responsibility for data protection and health-information security.
Where required by applicable law or healthcare regulatory requirements, the clinic will appoint or designate appropriate data-protection, health-information-security or data-governance personnel.
In Dubai, DHA requirements provide for a Data Protection Officer in circumstances specified by the applicable framework, including certain high-risk processing activities.
In Abu Dhabi, healthcare facilities are subject to the AAMEN and ADHICS V2 information-security and privacy framework.
24. DATA PROTECTION IMPACT ASSESSMENTS
Where required by applicable law or healthcare regulatory requirements, The Elixir Clinic will undertake appropriate privacy and data-protection risk assessments before introducing processing activities or technologies that may create a high risk to patient information.
For Dubai healthcare entities, DHA’s health-data protection framework requires DPIAs in specified circumstances, including annually and when initiating projects likely to result in high risk to protected health information.
25. THIRD-PARTY SERVICE PROVIDERS
The Elixir Clinic may use third-party service providers to support the operation of the clinic.
These may include providers of:
- IT systems;
- Patient-management systems;
- Booking systems;
- Healthcare information systems;
- Laboratory services;
- Payment processing;
- Communications;
- Website hosting;
- Website analytics;
- Cloud or technical services;
- Professional services; and
- Other operational services.
Where a third party processes personal or health information on our behalf, we will take appropriate steps to ensure that the processing is subject to applicable confidentiality, security and data-protection requirements.
26. YOUR RESPONSIBILITY
You are responsible for providing accurate and complete information to The Elixir Clinic.
You should inform us if your contact details or relevant medical circumstances change.
Providing accurate medical information is particularly important because incomplete or inaccurate information may affect the safety and appropriateness of your treatment.
You should also take reasonable steps to protect your own information when communicating with us through third-party platforms, including keeping your passwords and devices secure.
27. PRIVACY COMPLAINTS
If you have a concern or complaint regarding the way The Elixir Clinic has collected, used, stored, disclosed or otherwise handled your personal or health information, please contact us.
Privacy complaints should be submitted to:
Email: [email protected]
Please provide sufficient information for us to identify the issue and investigate your concern.
We will review complaints in accordance with our internal procedures and applicable legal and regulatory requirements.
Where applicable, you may also have the right to raise a concern with the relevant UAE data-protection, healthcare or regulatory authority.
28. CONTACTING US ABOUT YOUR PERSONAL INFORMATION
If you wish to:
- Request access to your information;
- Request correction of inaccurate information;
- Ask how your information is being processed;
- Ask about information sharing;
- Withdraw consent where applicable;
- Request deletion where legally available;
- Raise a privacy concern; or
- Ask any other question regarding your personal or health information,
please contact:
The Elixir Clinic
Email: [email protected]
Website: www.theelixirclinic.com
Please specify whether your request relates to the Dubai or Abu Dhabi clinic.
We may need to verify your identity before processing a request relating to your personal or health information.
29. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes to:
- Our services;
- Our systems;
- Our data-processing arrangements;
- Applicable laws;
- Healthcare regulations;
- Regulatory requirements;
- Technology; or
- Our privacy and security practices.
The latest version will be made available through our website.
Where a significant change materially affects how we process your personal information, we may provide additional notice where required.
30. GOVERNING LAW AND REGULATORY FRAMEWORK
This Privacy Policy is intended to operate in accordance with the applicable laws and regulations of the United Arab Emirates and the specific healthcare regulatory requirements applicable to the relevant The Elixir Clinic branch.
This includes, where applicable:
- UAE federal data-protection requirements;
- UAE healthcare data and information-security legislation;
- Dubai Health Authority requirements applicable to the Dubai clinic;
- Department of Health – Abu Dhabi requirements applicable to the Abu Dhabi clinic;
- Applicable health-information exchange requirements;
- Applicable data-security requirements; and
- Other applicable healthcare, privacy and regulatory requirements.
Where a mandatory legal or regulatory requirement conflicts with a provision of this Privacy Policy, the applicable law or regulatory requirement will take precedence.
The Elixir Clinic will maintain its internal policies, procedures and technical controls in accordance with the requirements applicable to each clinic.
31. CONTACT DETAILS
Dubai Clinic
The Elixir Clinic Dubai
583 Jumeirah Street
Umm Suqeim 1
Dubai, United Arab Emirates
Abu Dhabi Clinic
The Elixir Clinic Abu Dhabi
Villa A04, Marina Village
Abu Dhabi, United Arab Emirates
General Contact
Website: www.theelixirclinic.com
Email: [email protected]
For Dubai-specific queries, please refer to the Dubai branch.
For Abu Dhabi-specific queries, please refer to the Abu Dhabi branch.
The Elixir Clinic reserves the right to update this Privacy Policy from time to time.
Original Effective Date: 2013
Last Updated: August 2026
