Data Protection & Security Policy

1. Purpose and Scope

This Data Protection & Security Policy (“Policy”) sets out how Seven Dimensions Medical Centre, trading as 7 Dimensions Medical Centre / 7DMC (“7DMC”), governs personal data across all systems and channels it operates or uses, including:

• The public website, www.7dmc.ae;
• The Electronic Medical Record (EMR) system;
• The Odoo business platform (CRM, leads and operations);
• The mobile application;
• Marketing, advertising and communications platforms (Meta, Google, email marketing, WhatsApp, SMS, email).

This Policy should be read together with our Privacy Policy, Terms of Use, and EMR & Patient Health Data Policy.

2. Roles and Responsibilities

3. Legal Framework

This Policy is prepared with reference to the following UAE legislation.

Federal Decree-Law No. 45 of 2021 (UAE Personal Data Protection Law — PDPL)

Applies to general personal data processed by 7DMC (for example, enquiry, marketing and CRM data), and provides for lawful-basis requirements, data subject rights, security obligations and breach notification. Health data governed by its own legislation is outside the PDPL’s scope — in the UAE, health data is instead governed by Federal Law No. 2 of 2019 (below).

Federal Law No. 2 of 2019 (Use of ICT in Health Fields)

Governs health data specifically. Key obligations relevant to 7DMC:

• Health data relating to services provided in the UAE may not be stored, processed, generated or transferred outside the UAE, unless an exception is approved by the relevant health authority (Article 13);
• Health data must be retained for a minimum of 25 years from the date of the patient’s last health procedure (Article 20);
• Health Service Providers must keep health data confidential and implement technical, operational and organisational security measures, and this extends to healthcare IT providers and outsourced/cloud service providers;
• Violation of the data-localisation requirement carries fines of AED 500,000–700,000.

DHA Licensing Conditions

As a DHA-licensed facility (License No. 3339141), 7DMC is also subject to DHA’s patient confidentiality and health-information standards.

4. System Inventory and Hosting

5. Data Localisation Commitment

In line with Federal Law No. 2 of 2019, 7DMC’s clinical/health data is currently hosted within the UAE by TenderCare FZE, the provider of our Capsule EMR system. 7DMC is planning to migrate EMR hosting to Amazon Web Services within the UAE (AWS me-central-1) as part of its digital transformation programme with Ci CORP Digital; this Policy will be updated once that migration is complete. Our Odoo platform, which holds business and lead data (not clinical records), is separately hosted on AWS within the UAE.

6. Data Classification

7. Access Control

Access to 7DMC systems follows the principle of least privilege:

• Clinical/EMR data is accessible only to the treating doctor and authorised clinical/administrative staff involved in that patient’s care;
• Reception and front-desk staff access appointment and contact data required to manage bookings;
• TenderCare FZE’s access to Capsule is limited to hosting and platform support, under TenderCare’s own confidentiality and data protection terms as our EMR vendor;
• Ci CORP Digital currently has no access to clinical EMR data; its access is limited to what is required for Odoo, website and app development and infrastructure administration, under confidentiality obligations to 7DMC;
• Marketing team access is limited to Odoo CRM and marketing-platform data — marketing staff do not have access to clinical/EMR records.

8. Third-Party / Sub-Processor Register

9. Data Subject Rights Handling

Requests to access, correct, restrict or (where applicable) erase personal data should be directed to marketing@7dmc.ae. Requests relating to clinical/medical records are handled under the EMR & Patient Health Data Policy, which reflects the 25-year minimum retention requirement under Federal Law No. 2 of 2019 — medical records cannot be deleted on request before that period expires.

10. Breach Notification Procedure

In the event of a suspected data breach:

• Staff report the incident immediately to the Data Protection Contact (Altaf Hussein);
• TenderCare FZE (for EMR-related incidents) and Ci CORP Digital support technical containment and investigation;
• 7DMC assesses the risk to affected individuals and determines notification obligations to the UAE Data Office, DHA and affected patients, in line with legal requirements;
• A record of the incident, assessment and actions taken is maintained.

11. Cookie and Tracking Governance

The website currently uses analytics and advertising cookies (Google Analytics, Google Ads, Meta Pixel). We are implementing a cookie consent management tool to give visitors more granular control over non-essential cookies; this section will be updated once that work is complete.

12. Retention Schedule

13. Review Cycle

This Policy is reviewed at least annually, or sooner where there is a material change to 7DMC’s systems, vendors or applicable law. The “Last updated” date at the top of this page reflects the current version.

14. Contact

Seven Dimensions Medical Centre (7DMC)
Diamond Business Centre A, 1st Floor, Arjan, Al Barsha, Dubai, UAE
Data Protection Contact: Altaf Hussein — marketing@7dmc.ae