Privacy Policy
Last updated: 17 September, 2026
1. Introduction
Your privacy, and the confidentiality of your health information, matter to us. This Privacy Policy explains what personal data we collect through the website drdhanyarajkumar.com (the "Website"), why we collect it, how we use and protect it, who we share it with, how long we keep it, and what rights you have under United Arab Emirates law.
Please read this Policy together with our Terms and Conditions and our Medical Disclaimer.
2. Who is responsible for your data
Dr. Dhanya Rajkumar, Specialist Dermatologist, DHA Professional Licence No. 67345855-003, operating through Emirates Hospitals Clinics Business Bay LLC, is the Data Controller for personal data collected through this Website.
Contact for privacy matters:
Telephone: 0545397698
Telephone: 0545397698
3. Scope of this Policy
This Policy covers personal data that we collect through the Website and our associated enquiry channels (contact forms, appointment request forms, newsletter sign-up, email and WhatsApp).
It does not cover:
Your medical record. Once you attend a consultation, your clinical record is created and held by the DHA-licensed facility where you are treated — Emirates Hospital Clinic – Business Bay or iCARE Clinic – Oasis Centre. Each facility is a data controller in its own right for that record, and operates under its own privacy notice, its own DHA licence and its own information-governance framework. Requests to access, correct or obtain a copy of your medical record should be made to the relevant facility.
Third-party platforms. Facebook, Instagram, WhatsApp, Google and similar services process your data under their own privacy policies.
Your medical record. Once you attend a consultation, your clinical record is created and held by the DHA-licensed facility where you are treated — Emirates Hospital Clinic – Business Bay or iCARE Clinic – Oasis Centre. Each facility is a data controller in its own right for that record, and operates under its own privacy notice, its own DHA licence and its own information-governance framework. Requests to access, correct or obtain a copy of your medical record should be made to the relevant facility.
Third-party platforms. Facebook, Instagram, WhatsApp, Google and similar services process your data under their own privacy policies.
4. Legal framework we operate under
We process personal data in accordance with the laws of the United Arab Emirates, including:
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and its implementing regulations as issued and amended from time to time;
Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields (the "Health Data Law"), together with Cabinet Decision No. 32 of 2020 and Ministerial Resolution No. 51 of 2021;
Federal Decree-Law No. 4 of 2016 on Medical Liability and its implementing regulations, which impose a duty of professional confidentiality on licensed practitioners;
Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes;
Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services;
Federal Law No. 15 of 2020 on Consumer Protection; and
the standards, circulars and policies of the Dubai Health Authority ("DHA"), including the DHA Standards for Patient Consent and Managing Health Records and the DHA Standards for Medical Advertisement Content on Social Media.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and its implementing regulations as issued and amended from time to time;
Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields (the "Health Data Law"), together with Cabinet Decision No. 32 of 2020 and Ministerial Resolution No. 51 of 2021;
Federal Decree-Law No. 4 of 2016 on Medical Liability and its implementing regulations, which impose a duty of professional confidentiality on licensed practitioners;
Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes;
Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services;
Federal Law No. 15 of 2020 on Consumer Protection; and
the standards, circulars and policies of the Dubai Health Authority ("DHA"), including the DHA Standards for Patient Consent and Managing Health Records and the DHA Standards for Medical Advertisement Content on Social Media.
5. What personal data we collect
5.1 Data you give us directly
Through the appointment request form:
Full name
Mobile number and/or email address
Selected clinic location
Selected treatment of interest
Preferred date and time
Any notes or message you choose to add
Where you book for another person: that person's name and contact details, and your relationship to them
Through the contact form, email or WhatsApp:
Name, contact details, and the content of your message
Any images or documents you choose to send
Through the newsletter sign-up:
Email address and name.
During or after a consultation (held by the treating facility, and by us only where clinically necessary):
Medical and dermatological history, medications, allergies
Clinical photographs and treatment notes
Emirates ID / passport details and insurance details, where required for registration by the facility
Full name
Mobile number and/or email address
Selected clinic location
Selected treatment of interest
Preferred date and time
Any notes or message you choose to add
Where you book for another person: that person's name and contact details, and your relationship to them
Name, contact details, and the content of your message
Any images or documents you choose to send
Email address and name.
Medical and dermatological history, medications, allergies
Clinical photographs and treatment notes
Emirates ID / passport details and insurance details, where required for registration by the facility
5.2 Health-related data
Some of the information you give us — in particular the treatment you select on the booking form, or any symptoms, conditions or photographs you describe or send — is health-related personal data. Under UAE law this is treated as sensitive personal data and is subject to enhanced protection. We collect it only where it is necessary to arrange and deliver your care, and only with your consent or where UAE law otherwise permits.
Please note: we ask that you do not send detailed medical history, diagnoses, test results, medication lists or clinical photographs through the Website form, WhatsApp or ordinary email. These channels are not designed as secure clinical systems. Bring this information with you to your consultation instead.
5.3 Data collected automatically
When you visit the Website, we and our service providers may automatically collect:
IP address and approximate location (city/country level)
Browser type and version, device type, operating system, screen size
Pages visited, time spent, links clicked, referring website, search terms
Date and time of visit
Cookie identifiers and similar technologies
This is collected through Google Tag Manager and the analytics and marketing tools deployed through it (see section 12).
IP address and approximate location (city/country level)
Browser type and version, device type, operating system, screen size
Pages visited, time spent, links clicked, referring website, search terms
Date and time of visit
Cookie identifiers and similar technologies
5.4 Data from other sources
We may receive limited data about you from:
the Clinic where you are treated, for scheduling and follow-up purposes;
a family member or representative who books on your behalf;
publicly available sources such as a public review you post about our practice.
the Clinic where you are treated, for scheduling and follow-up purposes;
a family member or representative who books on your behalf;
publicly available sources such as a public review you post about our practice.
6. Why we use your data, and our legal basis
Where we rely on consent, you may withdraw it at any time (see section 10). Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect records we are required by law to retain.
7. Who we share your data with
We do not sell your personal data. We do not share it for third-party advertising purposes.
We may share your data with:
a) The DHA-licensed facility at which you are being seen — Emirates Hospital Clinic – Business Bay or iCARE Clinic – Oasis Centre — for registration, scheduling, clinical care and billing.
b) Other treating healthcare professionals, laboratories, pathology services or pharmacies, where necessary for your care and with your knowledge.
c) Our administrative and support staff, who are bound by confidentiality obligations.
d) Service providers acting on our instructions (data processors) — website hosting, IT support and maintenance, appointment/CRM software, email delivery, analytics providers, and payment processors. These providers are permitted to use your data only to deliver the service to us, under written terms requiring confidentiality and appropriate security.
e) Regulators and authorities — including the Dubai Health Authority, the Ministry of Health and Prevention, the UAE Data Office, courts, police or other competent authorities, where required by UAE law or a lawful order.
f) Insurers and third-party administrators, where you use insurance and have authorised the claim.
g) Professional advisers — lawyers, auditors, insurers — where necessary to protect our legal position.
h) A successor practice or entity, in the event of a transfer of the practice, subject to the same protections and to applicable law.
8. Storage location and cross-border transfers
Health data stays in the UAE.
In accordance with Article 13 of Federal Law No. 2 of 2019, health information and data relating to health services provided within the United Arab Emirates is stored and processed within the UAE and is not transferred, stored, processed or generated outside the UAE, except in the limited circumstances permitted by Ministerial Resolution No. 51 of 2021 or where expressly authorised by the competent health authority in coordination with the Ministry of Health and Prevention.
Non-health website data. Some ordinary technical and marketing data (for example, anonymised or pseudonymised analytics data, cookie identifiers, and email delivery logs) may be processed by service providers located outside the UAE. Where this happens, we transfer that data only:
to a jurisdiction recognised as providing an adequate level of protection; or
under appropriate contractual safeguards; or
with your explicit consent; or
where otherwise permitted under Articles 22 and 23 of the PDPL.
We do not route health-related data through these channels. If you would prefer that no analytics or marketing cookies are used during your visit, you can decline them (see section 12).
to a jurisdiction recognised as providing an adequate level of protection; or
under appropriate contractual safeguards; or
with your explicit consent; or
where otherwise permitted under Articles 22 and 23 of the PDPL.
9. How long we keep your data
Where we no longer need your data, we securely delete or irreversibly anonymise it.
10. Your rights
Subject to the conditions and exemptions in the PDPL and in health-sector legislation, you have the right to:
Be informed about how your data is processed — this Policy serves that purpose.
Access your personal data and obtain a copy of it.
Rectify inaccurate or incomplete data.
Erase your data, where it is no longer needed and where we are not legally required to keep it.
Restrict processing in certain circumstances.
Object to processing, including to direct marketing.
Data portability — receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
Object to automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. We do not currently make automated decisions of this kind about patients.
Withdraw consent at any time where processing is based on consent.
Complain to a supervisory authority.
Be informed about how your data is processed — this Policy serves that purpose.
Access your personal data and obtain a copy of it.
Rectify inaccurate or incomplete data.
Erase your data, where it is no longer needed and where we are not legally required to keep it.
Restrict processing in certain circumstances.
Object to processing, including to direct marketing.
Data portability — receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
Object to automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. We do not currently make automated decisions of this kind about patients.
Withdraw consent at any time where processing is based on consent.
Complain to a supervisory authority.
How to exercise your rights
Send your request to doctordhanyarajkumar@gmail.com. Please tell us clearly which right you wish to exercise. We may need to verify your identity before acting, to protect your data.
We will respond within 30 days of receiving a valid request, or notify you within that period if we need longer because the request is complex.
11. Children and minors
The Website is not directed at children. We do not knowingly collect personal data from anyone under 18 without parental or guardian involvement.
Where a patient is under 18:
verifiable written consent must be obtained from the parent or legal guardian before we collect, use or disclose that child's personal or health information;
a parent or legal guardian must attend consultations and sign consent forms;
no image, video or testimonial of a patient under 18 will ever be published without the prior written consent of the parent or legal guardian, in accordance with DHA requirements.
verifiable written consent must be obtained from the parent or legal guardian before we collect, use or disclose that child's personal or health information;
a parent or legal guardian must attend consultations and sign consent forms;
no image, video or testimonial of a patient under 18 will ever be published without the prior written consent of the parent or legal guardian, in accordance with DHA requirements.
12. Cookies and tracking technologies
What we use
This Website uses Google Tag Manager (container ID GTM-W4MNSXT7) to deploy the following categories of technology:
Strictly necessary cookies — required for the Website and its booking form to function, and for security. These cannot be switched off.
Performance and analytics cookies — for example Google Analytics, which helps us understand how visitors use the Website so we can improve it. Data is aggregated and, where possible, IP addresses are anonymised.
Functional cookies — remember your preferences, such as language or a dismissed banner.
Marketing and advertising cookies —for example the Meta (Facebook/Instagram) Pixel and Google Ads conversion tracking, if deployed. These may be used to measure campaign performance and, where you have consented, to show you relevant content on other platforms.
Important: we do not configure marketing tags to transmit health-condition data or the specific treatment you selected. If you deploy remarketing on this site, ensure that treatment-specific audience targeting is not used, as this could reveal sensitive health information about a visitor.
Strictly necessary cookies — required for the Website and its booking form to function, and for security. These cannot be switched off.
Performance and analytics cookies — for example Google Analytics, which helps us understand how visitors use the Website so we can improve it. Data is aggregated and, where possible, IP addresses are anonymised.
Functional cookies — remember your preferences, such as language or a dismissed banner.
Marketing and advertising cookies —for example the Meta (Facebook/Instagram) Pixel and Google Ads conversion tracking, if deployed. These may be used to measure campaign performance and, where you have consented, to show you relevant content on other platforms.
Your control
Non-essential cookies are set only with your consent, given through the cookie banner shown on your first visit. You may change or withdraw your choice at any time.
You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent the booking form from working.
Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
Non-essential cookies are set only with your consent, given through the cookie banner shown on your first visit. You may change or withdraw your choice at any time.
You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent the booking form from working.
Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
Retention
Cookie lifespans vary from the duration of your browsing session up to 26 months.
13. Marketing communications
We will only send you newsletters, offers or promotional content if you have actively opted in.
Every marketing message contains an unsubscribe link, and you can also unsubscribe by emailing or replying "STOP".
We will honour an unsubscribe request promptly and will keep a minimal suppression record so that we do not contact you again by mistake.
Marketing consent is entirely separate from your care. Declining marketing has no effect whatsoever on your appointments or treatment.
Appointment confirmations, reminders, aftercare instructions and administrative messages are service communications, not marketing, and you will continue to receive these while you are a patient.
We will only send you newsletters, offers or promotional content if you have actively opted in.
Every marketing message contains an unsubscribe link, and you can also unsubscribe by emailing or replying "STOP".
We will honour an unsubscribe request promptly and will keep a minimal suppression record so that we do not contact you again by mistake.
Marketing consent is entirely separate from your care. Declining marketing has no effect whatsoever on your appointments or treatment.
Appointment confirmations, reminders, aftercare instructions and administrative messages are service communications, not marketing, and you will continue to receive these while you are a patient.
14. Photographs, videos and testimonials
Clinical photography is a routine part of dermatological care and is used to document your condition and monitor your progress. Images taken for clinical purposes form part of your medical record and are kept confidential.
Clinical use and publication are two separate things.
We will never publish an image, video or testimonial of you — on this Website, on social media, or in any other material — without your prior, specific, written consent for that publication.
Consent for publication is requested separately from consent for treatment, and is entirely voluntary. Declining will not affect your care in any way.
You may withdraw your consent to publication at any time. On withdrawal we will remove the content from all channels under our control within a reasonable period. Please note that content already downloaded, shared or cached by third parties may not be fully retrievable.
Filming or live-streaming for promotional purposes is not carried out in operating theatres, in rooms where surgical or invasive procedures are being performed, or where a patient is sedated or unconscious.
We will never publish an image, video or testimonial of you — on this Website, on social media, or in any other material — without your prior, specific, written consent for that publication.
Consent for publication is requested separately from consent for treatment, and is entirely voluntary. Declining will not affect your care in any way.
You may withdraw your consent to publication at any time. On withdrawal we will remove the content from all channels under our control within a reasonable period. Please note that content already downloaded, shared or cached by third parties may not be fully retrievable.
Filming or live-streaming for promotional purposes is not carried out in operating theatres, in rooms where surgical or invasive procedures are being performed, or where a patient is sedated or unconscious.
15. How we protect your data
We apply technical and organisational measures appropriate to the sensitivity of the data, including:
encryption of the Website in transit (HTTPS/TLS);
access controls, so that staff can access only the data they need for their role;
confidentiality obligations in staff and contractor agreements;
secure, access-controlled storage of paper records and consent forms;
password policies and, where available, multi-factor authentication on administrative systems;
regular software updates and security patching;
written data-processing terms with our service providers;
staff training on patient confidentiality and data protection.
No system can be guaranteed completely secure. Transmission of data over the internet, WhatsApp or email is at your own risk, and we cannot guarantee the security of information you choose to send us through those channels.
encryption of the Website in transit (HTTPS/TLS);
access controls, so that staff can access only the data they need for their role;
confidentiality obligations in staff and contractor agreements;
secure, access-controlled storage of paper records and consent forms;
password policies and, where available, multi-factor authentication on administrative systems;
regular software updates and security patching;
written data-processing terms with our service providers;
staff training on patient confidentiality and data protection.
16. Data breaches
If a personal data breach occurs that is likely to prejudice your privacy, confidentiality or security, we will:
notify the competent authority without undue delay in accordance with the PDPL and, where health data is involved, the Health Data Law and DHA reporting requirements; and
notify you directly where the breach is likely to cause you serious harm, describing what happened, what data was involved, and what you can do.
notify the competent authority without undue delay in accordance with the PDPL and, where health data is involved, the Health Data Law and DHA reporting requirements; and
notify you directly where the breach is likely to cause you serious harm, describing what happened, what data was involved, and what you can do.
17. Third-party links and social media
The Website links to third-party platforms including Facebook, Instagram, WhatsApp, Google Maps and others. Once you leave the Website, or interact with us on those platforms, their privacy policies apply and we have no control over how they process your data.
Please do not post personal health information in public comments on our social media pages. If you need to discuss a health matter, contact us privately or book a consultation.
18. Changes to this Policy
We may update this Policy to reflect changes in our practice, our technology, or the law. Material changes will be brought to your attention through a notice on the Website. The "Last updated" date at the top shows when this version took effect. We encourage you to review this page periodically.
19. Contact us
Dr. Dhanya Rajkumar — Specialist Dermatologist DHA Professional Licence No. 67345855-003
Privacy enquiries: doctordhanyarajkumar@gmail.com
General enquiries: doctordhanyarajkumar@gmail.com
Telephone / WhatsApp: +971 54 539 7698
If you have a concern about how your personal data or health information has been handled, please contact us first — we take every such concern seriously and will investigate it fully.
Contact via WhatsApp