Privacy Policy

This policy explains what personal information we collect when you use the WIMS360 client portal and our services, why we collect it, who receives it, and the choices and rights you have.

1) Who is responsible for your information

Precision Health Clinix FZ-LLC is the healthcare provider responsible for your information when you receive care and services from us. We are licensed by the Dubai Health Authority (licence No. 3275401) and registered in Dubai Science Park, Dubai, United Arab Emirates (commercial licence No. 100155). Our clinical facility is at Al Barsha South First, Tecom Investments FZ LLC building, Unit 3, Dubai.

The WIMS360 platform is operated for us by Litpeaks FZ-LLC, which hosts, supports and secures the platform strictly on our instructions. Litpeaks does not use your information for any purpose of its own.

If you access WIMS360 through a different clinic, laboratory or wellness provider, that organisation is responsible for the information it holds about you, and its own privacy notice applies alongside this one.

2) What we collect, and where it comes from

Identity and contact Name, date of birth, contact details, identity verification information, and your account credentials.
Health and clinical Examination records, history and intake forms, test orders and laboratory results, reports, care plans, the supplements and therapies recommended to you, and notes from your consultations.
Genetic Genetic and genomic data — collected and analysed only where you have given your separate, explicit consent to genetic testing.
Lifestyle and device Wellness questionnaires and, if you choose to connect a device, wearable readings.
AI interactions If you have AI insights switched on, your questions to the AI features and the responses generated for you form part of your record.
Payment Records of what you bought and paid. Card payments are processed by our payment service provider; we do not store full card numbers. Prices, payment, cancellation and refunds are covered by our Terms of Use and any agreement you have with us, not by this policy.
Technical Sign-in records, device and usage information needed to run the service securely.
Where it comes from. Your information comes from you, from the professionals involved in your care, from the laboratory performing your tests, from devices you choose to connect, and — where you reach us through another provider organisation — from that organisation.

What you must provide. Identity, contact and relevant health information is needed to open an account and provide safe care; without it we may be unable to provide a service, or a professional may be unable to interpret a result safely. Everything connected to an optional feature is exactly that — optional — and declining it never affects your core care.

3) Why we use it, and the legal basis

UAE law, including UAE health-data law, is the primary law applying to our processing. The last two columns state the corresponding bases under the EU GDPR for any processing to which EU law applies.

Purpose Basis (GDPR Article 6) Health-data condition (Article 9)
Clinical care — examinations, consultations, care plans, and the supplements and therapies your clinician recommends as part of that care Performing our agreement with you — Art. 6(1)(b) Provision of health care by a licensed facility under professional obligations — Art. 9(2)(h)
Laboratory testing ordered for you, and delivery of results Performing our agreement with you — Art. 6(1)(b) Provision of health care — Art. 9(2)(h)
Genetic and genomic analysis Your consent — Art. 6(1)(a) Your explicit consent — Art. 9(2)(a)
Your account, payments and support Performing our agreement with you — Art. 6(1)(b) Health information is not required for these; where you choose to include it, for example in a support request, the care condition above applies — Art. 9(2)(h)
Keeping the platform and your record secure Our legitimate interest in running a secure service — Art. 6(1)(f) Security processing of health records rests on the care condition — Art. 9(2)(h)
Healthcare record-keeping, licensing, safety and financial duties Compliance with a legal obligation — Art. 6(1)(c) Provision and management of health care — Art. 9(2)(h)
Optional features — AI insights, recording, research, connected devices, marketing Your consent — Art. 6(1)(a) Your explicit consent, where the feature involves health data — Art. 9(2)(a)
Each purpose relies on the single basis stated for it. We do not rely on your consent for anything in this table except the rows that say so — which is why withdrawing a consent never affects your core care.

Supplements and therapies recommended to you are part of clinician-led care: they are proposed or approved by a licensed clinician, you are free to decline them, and they are not marketing. We rely on the bases in the first row of this table for them — and, where a record-keeping duty applies, on compliance with a legal obligation. We ask for your separate consent only for marketing, for research unrelated to your care, and for the other optional features listed above.

4) Your choices — and what withdrawal does

You control the optional features. AI processing has an on/off switch in your privacy settings that you can change at any time. Each other optional use — research, devices, recording, marketing — is asked for separately in the app, and each can be withdrawn.

Withdrawing a choice stops that use going forward. For example, switching AI off stops your information being sent for AI processing. Information already created under your earlier choice — AI conversations, files and generated outputs — stays in your record until the end of its retention period. If you want it deleted sooner, ask us at [email protected]: we will then delete it from the systems we control and ask the provider concerned to delete the copies held for our account; the provider removes them within its own published period. Where a legal obligation requires us to keep a record, we keep only what that obligation requires and will tell you what is retained and why when you ask. Withdrawal does not make the processing that lawfully happened before it unlawful.

5) Who receives your information

We share your information only as needed to provide your services, and we never sell it.

Your care professionals The clinicians and wellness professionals involved in your care, including external professionals you are referred to.
Litpeaks FZ-LLC Operates the WIMS360 platform on our instructions — hosting, support, security and deletion. No independent use.
The performing laboratory (Agiomix FZ-LLC) Processes the samples we order for you, on our instructions, and returns the results to us. As a licensed laboratory it also keeps the records the law independently requires it to keep, and it is responsible in its own right for those records.
AI provider (OpenAI) Receives information only while AI insights are enabled for your account. Only the minimum information approved for the feature is sent, never your complete clinical record. OpenAI processes it under the data processing agreement we have signed with it and does not use it to train its models.
Connected device providers (Terra and Ultrahuman) If you choose to connect a wearable, Terra — or, for an Ultrahuman device, Ultrahuman — carries the readings from your device or its app into your record. Each receives only the data needed for that connection, and only while the connection is active.
Service providers Hosting (Amazon Web Services); payment processing (Stripe); in-app messages and notifications (Pusher); WhatsApp notifications (Interakt, using WhatsApp by Meta); email (Microsoft Outlook); marketing emails (Brevo) and WhatsApp marketing messages (Interakt), only if you agree to receive marketing; and mobile push notifications (Google Firebase) — each only for its function and with no more information than that function needs. We are completing the verification of each provider’s contract, location and settings, and will update this list if anything changes.
Authorities Regulators, courts and health authorities where the law requires it.
We do not share your health information with any organisation for its own advertising, and no organisation listed above may use your information for purposes beyond those described here.

Business transfers. If Precision Health Clinix FZ-LLC is part of a merger, restructuring or transfer of its business, including to another company in the same group, your information may be transferred to the successor as part of that transaction. The successor must use it only for the purposes described in this policy, with the same protections, and must respect the choices you have made. We will tell you before any change in the company responsible for your information, or in how or where it is used, takes effect. Where the law requires a new legal basis, transfer safeguards or your consent, we will put these in place or ask you first. A business transfer never permits the sale or licensing of your identifiable health or genetic information.

6) Where your information goes

Processing Location When
Platform hosting and database Amazon Web Services, Mumbai, India Always
Raw genetic sequencing Agiomix FZ-LLC, on its own on-premises systems at its licensed premises in Dubai Science Park, Dubai, United Arab Emirates Where you undergo genetic testing; derived results are then stored on the platform
Laboratory orders and results Agiomix FZ-LLC, using the LIMS360 laboratory system hosted on Amazon Web Services in Mumbai, India (the same hosting as the platform) When tests are ordered for you; results are then returned to your record on the platform
AI processing OpenAI, L.L.C., United States, under OpenAI’s data processing agreement, which includes the EU Standard Contractual Clauses and UK Addendum where they apply. OpenAI deletes the copies held for our account when we instruct it to Only while you have AI insights switched on
Connected devices Terra Enabling Developers, Inc., United States; for Ultrahuman devices, Ultrahuman Healthcare Private Limited, India While a wearable connection is active
Messages and notifications Pusher Ltd, United Kingdom, with data processed in the United States (US East, N. Virginia); Microsoft (Outlook email), in the Microsoft 365 data location for our organisation; Google Firebase, United States; Interakt, India, with WhatsApp message data handled by Meta in North America and the European Union; Brevo (Sendinblue SAS), France, for marketing emails if you agree to receive them When a message or notification is sent to you
Where UAE law restricts the transfer of health information outside the United Arab Emirates, we transfer it only where a legal exception or approval applies, and we record the basis and safeguards for each location before the transfer starts. Where EU or UK data-protection law applies to a transfer, we use the European Commission’s Standard Contractual Clauses or the UK Addendum. You can ask [email protected] which legal safeguard applies to a specific transfer, and we will tell you what it is and how to see it.

7) How long we keep it

Each category below is kept for the period set in our retention schedule. The schedule records, for each category, the retention period, the reason, the starting event, what happens at the end, the backup cycle and the person accountable, and it is controlled by our legal team against the healthcare, tax and commercial record-keeping duties that apply to us. You can ask [email protected] for the period that applies to any category.

Clinical and examination records Why: healthcare record-keeping duties that apply to a licensed facility. Counted from: your last examination, consultation or episode of care. At the end: the record is deleted.
Genetic data and reports Why: it forms part of the clinical record it belongs to. Counted from: the date the analysis is reported to you. At the end: deleted with the clinical record; the genetic analysis notice explains what withdrawal can remove earlier.
AI conversations and outputs Why: they form part of your record while your AI choice is active. Counted from: the date the conversation or output is created. At the end: deleted at the end of the period in our schedule, or earlier if you ask us after withdrawing your AI choice, except where a legal duty applies.
Wearable readings Why: to show your trends while a device is connected. Counted from: the date the reading is received. At the end: deleted at the end of the period in our schedule, or earlier if you ask us to delete readings after disconnecting.
Recordings of consultations Why: made only with your separate agreement, for the purpose stated in the recording notice. Counted from: the date of the consultation. At the end: deleted at the end of the period stated in that notice.
Account, payment and tax records Why: commercial and tax record-keeping duties. Counted from: the date of the transaction, or the closure of your account. At the end: the records are deleted.
Consent and acceptance records Why: to evidence the choices you made and when you made them, including the notice version shown to you. Counted from: the date the choice is given, changed or withdrawn. At the end: kept for as long as we must be able to evidence the choice, then deleted.
Security and access logs Why: to investigate and evidence security events. Counted from: the date the event is recorded. At the end: the logs are deleted.
Backups Why: to restore the service after a failure. Counted from: the date the backup is taken. At the end: backups expire on a fixed cycle of no more than 30 days; information you asked us to delete remains only until the backup holding it expires, and if we restore from a backup, the deletion is applied again.
When no purpose or legal duty applies, information is deleted. We treat information as anonymous only after a documented assessment shows you can no longer reasonably be identified from it — until then, coded or pseudonymised information is still treated as personal information.

8) How we protect it

We apply administrative, technical and organisational safeguards appropriate to the sensitivity of health information, including access controls that limit records to the people involved in your care, and we review those safeguards as part of our compliance programme. No online service can promise absolute security, so please also protect your own account with a strong password and multi-factor authentication.

9) AI features

AI-assisted insights are built as support for the professionals and for you — they inform, and do not replace, professional judgement. While AI insights are switched on for your account, only the minimum information approved for the feature you are using — which may include relevant clinical details and your questions to the feature, but not your complete clinical record — is sent to OpenAI for processing on our instructions. OpenAI processes this information under the data processing agreement we have signed with it, and does not use it to train its models. Your AI conversations form part of your record (section 2). When you switch AI off, we stop sending your information for AI processing. Conversations and outputs created before then stay in your record until the end of their retention period, unless you ask us to delete them sooner, as explained in section 4; we confirm what has been deleted if you ask, and we do not claim a deletion we cannot evidence. We do not use AI to make decisions with legal or similarly significant effects for you without the involvement of the professionals responsible for your care.

10) Connected devices and wearables

Connecting a wearable is your choice and is never required for your care. Before you connect, we show you a notice explaining what the connection does; you then complete the connection through Terra, our connection provider. We record that you connected, for what purpose, which version of the notice you were shown, and when — and we keep that record as evidence of your choice.

Purpose: to show your activity and health trends alongside your clinical record, so that you and your professionals can use them in your care. What is collected: the readings your device or app makes available for the connection you authorise — for example steps and activity, heart rate and variability, sleep, blood oxygen, glucose where your device measures it, and body measurements. Who receives it: Terra, which carries the readings from your device or its app into your record, and the professionals involved in your care; the maker of your device also handles the data under its own privacy notice. Where it goes: Terra is operated by Terra Enabling Developers, Inc. in the United States, under a data processing agreement that includes the EU Standard Contractual Clauses and UK Addendum where they apply; for Ultrahuman devices, readings are received from Ultrahuman Healthcare Private Limited in India. How often: while the connection is active, as your device or app makes readings available — usually continuously or at regular intervals through the day.

Disconnecting: you can disconnect a device at any time in your privacy settings, and no further readings are collected once you do. Readings already collected: they stay in your record so that your care history remains complete, and are kept for the period in our retention schedule. You can ask us to delete them at [email protected], and we will do so unless a legal duty requires us to keep them.

11) Research

Scientific research, the development of our services, and the training of models are each different things, and none of them happens with your identifiable information unless you have given a separate, specific consent for that use under an approved governance route.

Accepting the Terms, signing in, or accepting an updated version of this policy is never treated as permission for research use — including for information collected before the change. Where research uses anonymous information, we apply the anonymisation standard in section 7 first.

12) Your rights

Subject to applicable law, you can:

access your information and receive a copy of it;
receive it in a portable format, where applicable law provides that right;
correct information that is inaccurate or incomplete;
delete information, where no legal retention duty applies;
withdraw a choice you gave for any optional use, at any time;
object to or restrict certain processing;
complain to us, and to a data protection or health regulator.
To exercise any of these, contact [email protected]. We will confirm your identity, respond within the time applicable law allows, tell you clearly if anything cannot be actioned and why, and never charge for a reasonable request.

13) Children

Accounts are for adults. Information about a person under 18 is processed only under the registration of a parent or legal guardian, who manages that account and its choices until the young person can hold an account in their own right.

14) Changes to this policy

When we materially change this policy, we will publish the new version with a new version number and date and tell you in the app before the change takes effect. Where a change affects an optional use you consented to, we will ask for your choice again rather than carrying it forward.

15) Contact us

Privacy questions and rights requests [email protected]
General support [email protected]
Registered office Precision Health Clinix FZ-LLC, G02S, Ground Floor, Dubai Science Park (DSP) Towers – South, Dubai, United Arab Emirates
Clinical facility Al Barsha South First, Tecom Investments FZ LLC building, Unit 3, Dubai, United Arab Emirates
Precision Health Clinix FZ-LLC · DHA Health Facility Licence No. 3275401 · Commercial Licence No. 100155, Dubai Science Park