Privacy Policy / Политика конфиденциальности

Milena Longevity app · Effective date: 22 October 2026 · Version 1.0

This Privacy Policy explains how MILENA AESTHETIC CLINIC L.L.C (Dubai Department of Economy and Tourism commercial licence No. 1138649), operating the medical facility Milena Aesthetic Clinic (Dubai Health Authority health facility licence No. 1688574, Polyclinic), Dubai, United Arab Emirates (the "Clinic", "we"), processes personal data of users of the Milena Longevity mobile and web application (the "App").

1. Who we are and how to contact us

Data controller: MILENA AESTHETIC CLINIC L.L.C, Villa 892, Umm Suqeim 1, Bur Dubai, Dubai, United Arab Emirates. Phone: +971 56 454 4425. Privacy contact: info@milenaaesthetic.com.

2. What the App is

The App is a patient-management tool for the Clinic's Longevity programme. It lets a patient complete a health questionnaire, see laboratory tests and check-up packages prescribed by their treating doctor, upload laboratory results, view therapy recommendations, receive reminders and exchange messages with their doctor. The App is used only by patients of the Clinic and by the Clinic's medical and administrative staff. The App is not a medical device and does not replace a consultation with a doctor.

3. Data we collect

Category	Examples	Source
Account data	Name, e-mail and/or phone number, password (stored only as a cryptographic hash), patient number	You, at registration
Health data	Questionnaire answers (symptoms, family history, diagnoses, medications and supplements), prescribed tests and check-up packages, laboratory results you upload (PDF files are read on your device; only recognised values and the file name are stored), therapy recommendations, doctor's notes	You; your treating doctor
Communications	Messages exchanged with your doctor in the App chat	You; your doctor
Technical data	Session token, time of last activity, IP address in server logs (kept up to 30 days for security)	Automatically

We do not collect precise location, contacts, photos (other than laboratory reports you choose to upload), advertising identifiers or analytics about your use of other apps. We do not use third-party advertising or analytics SDKs.

4. Why we process your data and on what legal basis

• To provide the Longevity programme: questionnaire scoring, prescribing and tracking tests, therapy planning, reminders and doctor-patient communication. Legal basis: your explicit consent given at registration and the provision of healthcare services you requested.
• To keep the App secure: authentication, prevention of abuse, logging of access. Legal basis: our legitimate interest in protecting health data.
• To comply with UAE healthcare and data-protection law, including medical record-keeping obligations.

Applicable law: UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, UAE Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields, and the regulations of the Dubai Health Authority.

5. Where your data is stored

Health data is stored on servers located in the United Arab Emirates (Microsoft Azure, UAE North region, Dubai). We do not transfer health data outside the UAE except where UAE law permits and with your explicit consent.

6. Who can see your data

• Your treating doctor and other licensed medical staff of the Clinic involved in your programme.
• The Clinic's programme managers, for scheduling, reminders and programme administration (they see your name, patient number, programme status and chat; they do not make clinical decisions).
• Our hosting provider, as a processor acting on our instructions, with no right to use the data for its own purposes.

Other patients never see your data. We do not sell personal data and do not share it with advertisers. We disclose data to public authorities only when required by UAE law.

7. How long we keep your data

While your account is active and thereafter for the period required by UAE medical record-keeping rules (at least 25 years from the last encounter, under UAE Federal Law No. 2 of 2019 and the DHA Policy for Health Information Assets Management; 30 years for genetic test results). Account data not required for medical records is deleted within 30 days after you delete your account. Server logs are kept up to 30 days.

8. Your rights

• Access and correction. You can view and edit your questionnaire and profile in the App or ask us for a copy of your data.
• Deletion. You can delete your account at any time in the App (Patient cabinet → "Delete account"). This permanently removes your account, questionnaire, uploaded results, recommendations and chat from the App. Where UAE law obliges the Clinic to retain a medical record, that record is kept in the Clinic's medical records system, not in the App.
• Withdrawal of consent. You may withdraw consent at any time by deleting your account or contacting us; this does not affect processing already carried out.
• Complaint. You may contact us at the address above or lodge a complaint with the UAE Data Office.

9. Security

Data is transmitted over encrypted connections (HTTPS). Passwords are stored only as salted hashes. Access to health data is limited to authenticated users with the appropriate role; patients see only their own records. Repeated failed sign-in attempts are temporarily blocked.

10. Children

The App is intended for adults aged 18 and over. We do not knowingly create accounts for minors.

11. Changes

We may update this Policy. The current version is always available at this address; material changes will be announced in the App.