Privacy Policy

Third-Party Processing and Transfers Outside of ADGM

We may share your personal data with third parties to provide you with the best healthcare services and experiences possible, to run our business more efficiently, or to comply with the law. These entities might be other healthcare providers, laboratories, service providers such as technology or manpower providers, government agencies, authorities, and regulatory bodies. These may also include embassies, insurance companies, your employers, organisations that help us run our business such as consultancy firms, talent acquisition agencies, entities within NMC group and similar. These third parties may be independent or join data controllers or processors with whom we share your personal data for the following reasons:

If you are our patient,

to:

1. refer you to other specialist healthcare providers.
2. provide you with diagnostic testing and imaging services.
3. send you information about our services and products.
4. store your data.
5. provide you with requested service.
6. run our business.

If you are our business partner,

to:

1. run our enterprise resource planning systems such as procurement systems.
2. provide other general IT services.

If you are applying for a job at NMC,

to:

1. make use of technology platforms for recruitment purposes such as to conduct video interviews.
2. facilitate the candidate selection process.

Before transferring your personal data to any third party, we will carry out proper due diligence and, where possible, will ensure that we enter into an appropriate agreement with them. The agreement will clearly set out the respective roles of each Controller to the agreement or will instruct Data Processors on the purposes for which they can process the personal data, as well as the standards they must adhere to.

Where we transfer personal data to another jurisdiction, we use appropriate safeguards such as contractual clauses adopted by the ADGM Commissioner of Data Protection. This will not however be necessary if the transfer is necessary to enable a contract between you and the recipient Controller to be performed or when you have asked us to take steps to enable you to enter into such a contract.

Retention of Personal Data

We follow all applicable laws governing the retention of your data and will not keep it in an identifiable format for longer than reasonably necessary.

We retain the data we collect from you for different periods depending what is required by law, on your preferences, where applicable, and the purposes we use it for. The personal data that we retain falls into the following categories:

1. Information we keep for periods set by law such as UAE Federal Law No. 2 of 2019 which requires patient health data to be stored for at least 25 years.
2. Information retained until you remove it – we keep this data until you ask us to delete it. Types of information included in this category are contact details used for marketing or research purposes, information we hold about you for recruitment purposes, etc.
3. Non-health information retained for specific business or legal purposes. For example, when we process a payment to or from you, we will retain this data for periods that may be required for tax or accounting purposes. Examples of this include:

1. Financial information: such as invoices, receipts to enable us to maintain proper accounts and tax records.
2. Insurance information: such as your insurance claims and related records to ensure that your accounts are settled and that we maintain proper accounting records.
3. Incident Reports: we may retain your personal data for quality assurance purposes set by local regulations.

Your Rights

You may have certain legal rights regarding your personal information depending upon the jurisdiction in which you are located or how we interact with you. You can exercise your rights by sending an email to the NMC Healthcare Group Data Protection Officer at dpo@nmc.ae. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information to fulfil your request.

You can learn more about these rights here.

Subject to the terms of this Privacy Statement you have the right to:

To access your personal information.

You have the right to request that we provide you with a copy of your personal information that we hold, and you have the right to be informed of,

1. (a) the purposes of the processing and the categories of personal data being processed;
2. who will receive the personal data;
3. where possible, how long we expect to keep the personal data, and if not possible, the criteria we use to determine that period;
4. where the Personal Data was not collected from you, any available information as to its source; and
5. the existence of automated decision-making, including profiling and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject.

To lodge a complaint with us.

We will receive and handle your complaints in accordance with best practice and depending on where you are and whether we are subject to it, any applicable law.

Right to rectify or erase personal information.

You have the right to ask us to rectify inaccurate personal information we have collected from you where it is technically feasible for us to do so. In so doing, we may however take steps verify the accuracy of the personal information before rectifying it.
You can also ask us to erase your personal information in limited circumstances where:

1. it is no longer needed for the purposes for which it was collected; or
2. you have withdrawn your consent (where the data processing was based on consent); or
3. following a successful exercise of the right to object; or
4. it has been processed unlawfully; or
5. to comply with a legal obligation to which NMC Healthcare Group is subject; or
6. for the establishment, exercise, or defence of legal claims.

Right to restrict the processing of your personal information.

You can ask us to restrict your personal information, but only where:

1. its accuracy is contested, to allow us to verify its accuracy; or
2. the processing is unlawful, but you do not want it erased; or
3. it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
4. you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal information following a request for restriction, where:

1. we have your consent; or
2. to establish, exercise or defend legal claims; or
3. to protect the rights of another natural or legal person.

Right to transfer your personal information.

You can ask us to give your personal information to you in a structured, commonly used, machine-readable format. You can also ask to have it transferred directly to another data controller, but in each case only where:

1. the processing is based on your consent or on the performance of a contract with you; and
2. the processing is carried out by automated means.

Right to object to the processing of your personal information.

You can object to any processing, including profiling, of your personal information which has our legitimate interests as its legal basis if you believe your fundamental rights and freedoms outweigh our legitimate interests. This can be done at any time.

If you raise an objection, we have the option to demonstrate that we have compelling legitimate interests which override your rights and freedoms or that processing is necessary for the establishment, exercise, or defence of legal claims. Where we cannot do this, we will cease to process your personal data.

Where your personal Data is Processed for archiving and research purposes, you have the right to object to having your personal data processed, unless it is necessary to perform a task we are carrying out for reasons of public interest.

Right to object to how we use your personal information for direct marketing purposes.

You can request that we change the way we contact you for marketing purposes. See Right to withdraw consent Section for more information on withdrawing consent.

You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.

Right to withdraw consent.

You can withdraw your consent at any time. The withdrawal of Consent will not affect the lawfulness of processing based on consent before it was withdrawn.

Right to obtain a copy of personal information safeguards used for transfers outside your jurisdiction.

You can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the ADGM or for any other restricted transfer. We may redact data transfer agreements to protect commercial terms.

Right to lodge a complaint with your local supervisory authority.

Where your personal data is processed by a member of NMC Healthcare Group that is registered within the ADGM, you also have the right to lodge any complaints or concerns regarding the use of their personal data with the ADGM Commissioner for Data Protection (both health and non-health personal data) the local data protection authority at data.protection@adgm.com

Verifying your identity

Where you decide to exercise any of these rights, we may request additional information from you to help us verify your identity or to confirm that you have given authority to another person to exercise these rights on your behalf.
We do however reserve the right not to restrict access to your information or to limit your rights (e.g., if such disclosure is prohibited by law or if the rights of another individual might be violated). In some instances, this may mean that we are able to retain your personal data even if you withdraw your consent. Please contact the Data Protection Officer at dpo@nmc.ae for more information about your rights or to exercise any of them.

Conflicts between Law and this Privacy Statement

If there is a conflict between this Privacy Statement and an applicable law, applicable law will apply to you. We will determine whether there is a conflict, so you do not have to.

Impact of Automated Decisions

We will not make any decision, policy, or assessment that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

Getting in Touch With Us

Your main point of contact for all issues arising from the use of your personal data, is the NMC Healthcare Group Data Protection Officer. The Data Protection Officer can be contacted in the following ways:

By email:

dpo@nmc.ae

By Post:

The Data Protection Officer,
NMC AssetCo,
10th Floor,
Al Ain Tower,
Khalidiya,
Abu Dhabi, UAE.
If you have any questions, concerns, or complaints regarding our compliance with this Privacy Statement and the data protection laws, or if you wish to exercise your rights, we encourage you to first contact us. We will investigate and attempt to resolve complaints and disputes and will make every reasonable effort to honour your wish to exercise your rights as quickly as possible and, in any event, within the timescales provided by data protection laws.

Restriction on Children’s Information

We do not knowingly collect personal data online directly from individuals under the age of 18 years. Adults who interact with NMC Healthcare Group should ensure that they have proper authority to transfer personal data belonging to children to NMC Healthcare Group (under 18 years). This means that the adult must either be the parent of the child in question or the legally recognised guardian.

Transferring Your Data Within NMC Healthcare Group

We will transfer your personal data to other entities within the NMC Healthcare Group where necessary.

Patients

If you are a patient, the facility where you had your initial consultation, we may share your personal data (including health data) with other NMC Healthcare Group facilities in certain circumstances and for specific purposes that are related to the delivery of health care services to you. These may include:

1. To refer your medical case to a more appropriate facility.
2. To refer your medical case to a more specialised or experienced healthcare professional within our extensive network.
3. To enable you pick up pharmacy prescriptions.
4. At your request, and with your consent, to enable you use any of our optional ancillary health care services using our Cosmetic Surgery or IVF providers.

Data Controller vs Data Processor
In most cases, your data will be accessed by the corresponding health provider through NMC Healthcare Group’s Health Information system. Both will be Joint Controllers with joint responsibility for processing your data. NMC AssetCo is a joint Controller for all the processing activities, outlined in section on ‘How we Use Your Personal Data’ above. NMC AssetCo will be responsible for facilitating the exercise of data subjects’ rights and will serve as a primary point of contact.

Definitions

“Personal data”, “personal information”, or “PII” means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly — in particular, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural, or social identity.

“Special Categories of Personal Data” refers to personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and the processing of data concerning health or sexual orientation.

“Sensitive personal data” either indicates “special categories” (see above) or is personal data of which the sensitivity level has been assessed and classified, indicating potential severe impact on an individual when confidentiality of such data is breached.

“Anonymised” is the deletion or changing of personal data in such a way that it can no longer be foreseeably assigned to a certain or ascertainable individual or only with a disproportionately high effort in terms of time, cost, and work.

“Consent” is any freely given, specific and transparently, unambiguous, well-informed indication of the will of the individual, whereby the individual agrees that his or her personal data may be processed. Particular requirements about consent can arise from the respective national laws. Where possible, consent is obtained in an explicit manner (unambiguously).

“NMC Healthcare Group” means, NMC OpCo Ltd and its subsidiaries. Click here for a detailed listing.

“NMC Healthcare Facility” means, a facility that is providing healthcare services such a hospital, clinic and similar.