NMC Healthcare Group have developed this Privacy Statement to explain how we collect, retain, use, process, share and transfer your personal data when you visit our facilities, use our services, or visit our websites. It has also been designed to help you understand your privacy choices whenever you interact with the NMC Healthcare Group.
NMC Healthcare Group is owned and operated by NMC OpCo LTD who's registered office is located at 15th, 16th & 17th Floors, Al Maryah Tower, Abu Dhabi Global Market Square, Al Maryah Island, PO Box: 764659, Abu Dhabi, UAE. It comprises several related businesses operating under the NMC, Cosmesurge, Provita, Americare, Aesthetics, brands in the UAE and Oman.
NMC Healthcare Group (also referred to as “we” or “us” elsewhere in this Privacy Statement) together are responsible for your personal data as Independent Controllers, Joint Controllers or Data Processors, depending on the purpose for which your data is being processed. Please see the section on Transferring Your Data Within the NMC Healthcare Group below for details.
Our privacy commitments are fundamental to the way we run our business. These commitments apply to everyone who has a relationship with us - including patients, partners, and website visitors. NMC Healthcare Group is committed to delivering personalised care that matters and to giving you the best overall experience whenever you use any of our services or interact with us. We strive to strike the right balance between using your data to ensure the quality of those experiences and protecting your privacy. We have thought through each aspect of our business and have determined just the right amount of data we need to create the best experience for you.
This Privacy Statement applies to all information we collect about you. It includes information we collect directly from you, information collected automatically, information we collect through our mobile application(s) and information we collect from third parties.
Personal data, also referred to as personally identifiable information (PII) is information that identifies or can reasonably be used to identify you. Anonymous information (i.e., information that does not or cannot be reasonably used to identify you specifically) and aggregate information (i.e., information taken from many peoples' data that is combined into groups or categories) are not considered personal data.
Examples of personal data include your:
We may also process more sensitive personal data (also known as Special Category Data) including information relating to racial and ethnic origin, religious, political, or philosophical beliefs, trade union membership or information about your health, disabilities, and sexual orientation.
Personal information does not include:
We want you to know exactly what data we collect and use. NMC Healthcare Group may collect and use the following information:
We also collect and use more sensitive personal data (known as "Special Category Data") about you, such as information relating to your physical and mental health or your religion.
Special category data must be handled even more sensitively than “standard” personal data. Your special category personal data will be managed in accordance with the Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021 (ADGM DPR) where applicable.
The special category personal data we hold about you may include some or all the following:
The confidentiality of your medical information is important to NMC Healthcare Group. We make every effort to prevent unauthorised access to and use of information relating to your physical and mental health. In doing so, we comply with UAE Data Protection Laws and Standards, including the Federal Law No. (2) of 2019 Concerning the Use of Information and Communication Technology (ICT) in Health Fields, and the Abu Dhabi Healthcare Information and Cyber Security Standard v2 (ADHICS v2) where applicable.
We use your personal data in a variety of ways in order deliver you with the healthcare services that you need. We also use personal data belonging to our patients, and business partners to run our business and to comply with our legal obligations. Where you apply for a job at NMC Group, we need to process your personal data as part of our recruitment process.
Directly From You
We may collect personal data directly from you when you:
From Other Healthcare Providers
Our patients will often receive healthcare services from other organisations in addition to NMC Healthcare Group, and so to provide you with the best care possible we may have to collect personal data about you from these other organisations. This may include medical records from:
If you are a patient in the UAE, your health data will most likely also be held and processed in either Emirate’s Health Data Information Exchange Platform. These are known as Malaffi in Abu Dhabi, Nabidh in Dubai, and Riayati in the Northern Emirates (Sharjah, Ajman, Umm Al Quwain, Fujairah, and Ras Al Khaimah). Your profile in either or each of these platforms holds an electronic record of your patient information, including medication, allergies, bad reactions to medicines, and where available past and present medical information, created from your NMC Healthcare Group medical record. They can be seen and used by authorised staff, within NMC Healthcare Group and in other areas of the UAE health and care system, who are directly involved in your care. Access to your record in these systems optimises patient safety allowing us to make the most clinically informed decisions. You can find more information about Malaffi here , about Nabidh, here and Riayati here
From Other Third Parties
We may also collect personal data about you from other third parties in the following ways:
In such cases, we will inform you that we have received your personal data from third parties, along with required information under applicable data protection laws.
We use (or “process”) your personal data for several different purposes but in all cases, we must have a legal basis for doing so. When we use Special Category personal data such health data, (see section on Special categories of personal data above) we must have a specific additional legal basis to do so.
NMC Healthcare Facilities and NMC Group Services jointly process your personal data as joint controllers. Both parties participate in determining the purposes and means of processing personal data relating to NMC Group patients.
NMC Group Services relies on legitimate interests as its legal basis for processing personal data, in accordance with UAE regulations. Please note, you have the right to object to processing based on legitimate interests. For more information on how to exercise your right, please refer to the Your Rights section, specifically the Right to Object to the Processing of Your Personal Information.
When processing Special Category Data (e.g., health-related data), NMC Group Services relies on the condition that processing is necessary for reasons of public interest in public health, to ensure continued high standards of quality and safe healthcare, as well as the proper management of medicinal products or medical devices.
Below, we outline the purposes for which NMC Healthcare Facilities process your personal data and the legal bases for such processing, in compliance with applicable UAE Data Protection Regulations, including the ADGM DPR, ICT, ADHICS v2 and Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (United Arab Emirates) (UAE PDPL) where applicable:
| No. | Purpose | Details | Legal Basis Under ADGM DPR | Special Category (Health) Data Under ADGM DPR | Legal Basis Under Other UAE Laws or Standards |
|---|---|---|---|---|---|
| 1 | To set you up as a patient and process your data in NMC Healthcare Group’s systems. |
We use your personal data to create a Medical Record within our systems in which we will hold your medical history. We also use it to establish your identity and the method you will use to pay for the services that we provide you with (i.e., via your insurance provider, cash, or some other means). |
Contract Providing personal data is a requirement to enter a contract. Failure to provide personal data would prevent us from entering a contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 2. | To provide you with healthcare and related services |
This is the primary reason you are likely to visit any of our facilities or use our services. We will therefore process your personal and health data for that and related purposes. We may also need to carry out diagnostic tests or imaging procedures, some of which may be conducted within the facility you visit while others may be conducted at other NMC Healthcare Group facilities or by specially vetted third parties in compliance with local regulations. This means that some of your data might need to be shared with other hospitals within NMC group or other third parties. |
Contract Or Legitimate interest |
Health Purposes Processing is necessary for health purposes. |
ADHICS v2 ICT Law |
| 3. | Data sharing with Laboratories | As part of your medical care, we may need to conduct laboratory tests. While some tests may be performed within the facility you visit, others may be carried out by external laboratories. In such cases, we may need to share relevant personal and health data with these laboratories. | Contract We need to process your health information to perform our healthcare contract with you. You are required to provide personal data to perform our contract with you. If you do not provide us with your personal data, we will be unable to perform our contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 4. | International Patient Services | International patients and embassies approach NMC for healthcare arrangements. NMC coordinates with the relevant facility, and treatment proceeds as for local patients. | Contract We need to use your personal data to take steps so that you can enter a contract with us and/or a healthcare professional to provide your care. Providing personal data is a requirement to enter a contract. Failure to provide personal data would prevent us from entering a contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 5. | To provide you with medical services in cases of emergency | Where there is a risk to your life or other consequences may occur that would cause you great harm, we need to process personal and health data to protect your vital interests. Sometimes, we need to share your data with third parties in order the achieve that. |
Vital Interests
|
Vital Interests Processing is necessary to protect vital interests of the Data Subject or of another natural person where the Data Subject is physically or legally incapable of giving Consent. |
ADHICS v2 ICT Law |
| 6. | To settle your account | We will use your personal and health data to ensure that your account and billing is fully accurate and up to date. This may include sharing your personal information with your health insurance provider, employer, other entity that may fund your treatment, or authorised government systems (e.g. Shaf Afiya) both before and after you receive treatment at any of our healthcare facilities. | Contract We need to process your personal and health information to perform our healthcare contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering a contract. |
ADHICS v2 ICT Law |
| 7. | For internal or government clinical audit related to our Abu Dhabi Hospitals. | We may share your personal data with government auditors, Clinical Outcome Review Programmes and other government led quality improvement projects. We may also share your personal data with other audit programmes set up by clinical standards accreditation bodies such as Joint Commission International. Additionally, we may use your anonymised data for internal quality assurance initiatives, including peer reviews conducted within the NMC Group to assess and improve clinical reporting standards. |
Legitimate Interests Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Right to Object to The Processing of Your Personal Information for more information. |
Public Interests Processing is necessary for reasons of public interest in public health to ensure continued high standards of quality and safe health care, of medicinal products or medical devices. |
ADHICS v2 and At the request of the regulatory body(ies) for the purposes of inspection, supervision and protection of public health. Or Processing shall be necessary to protect public health and include protection from communicable diseases and epidemics or for the purposes of ensuring the safety and quality of health care, medicines, drugs and medical devices in accordance with the applicable legislation. ICT Law |
| 8. | For internal or government clinical audit at our hospitals outside of the Emirate of Abu Dhabi. | We may share your personal data with government auditors, Clinical Outcome Review Programmes and other government led quality improvement projects. We may also share your personal data with other audit programmes set up by clinical standards accreditation bodies such as Joint Commission International. Additionally, we may use your anonymised data for internal quality assurance initiatives, including peer reviews conducted within the NMC Group to assess and improve clinical reporting standards. |
Legitimate Interest Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Right to Object to The Processing of Your Personal Information for more information. |
Public Interests Processing is necessary for reasons of public interest in public health to ensure continued high standards of quality and safe health care, of medicinal products or medical devices. |
ICT Law Protecting public health or the health and safety of patients. |
| 9. | Contacting you and resolving queries or complaints. | There may be times when you raise queries or complaints with us, including those submitted through the MOHAP or Sheryan portal or other channels such as online reviews or social media. We take those communications very seriously and will usually need to use your personal data to resolve them fully. |
Legitimate Interests Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Right to Object to the Processing of Your Personal Information for more information. |
Public Interests Processing is necessary for reasons of public interest in public health, such as protecting against serious threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices. |
ADHICS v2 If complaint was raised through the MOHAP or Sheryan portal: At the request of the regulatory body(ies) for the purposes of inspection, supervision, and protection of public health. ICT Law |
| 10. | Providing you with service information. | We will use contact information you have given us to get in touch with you regarding your care and ongoing healthcare needs. This includes reminders about upcoming or missed appointments, notifications about test results, and follow-ups related to your recent visits. We may also contact you as part of our care management efforts, ensuring that you receive the necessary guidance on your treatment plan, preventive screenings, medication adherence, and other relevant health services. These communications are intended to support your health journey and will be delivered via telephone, SMS, email or by messenger app (such as WhatsApp). Please note that some of these messages may be automated. |
Contract Providing personal data is a contractual requirement. Failure to do so might prevent us from perform our contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 11. | Medical research | We also participate in medical research and may share personal data with government approved research projects. Any data shared for research purposes will be pseudonymised or anonymised to protect your identity, and we will take appropriate measures to safeguard your data. | Your Consent We will obtain your consent before using your personal data for any medical research purposes to bring healthcare improvements to the public. |
Explicit consent You can withdraw your consent at any time by contacting the doctor that conducted the research in which you participated or by providing their name to [email protected]. |
ADHICS v2 ICT Law |
| 12. | Medical research where your consent has not been obtained. | We also participate in medical research and may share personal data with government approved research projects where allowed by regulatory bodies in the country. Any data shared for research purposes will be anonymised to protect your identity, and we will take appropriate measures to safeguard your data. |
Legitimate Interest Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Right to Object to the Processing of Your Personal Information for more details. |
Research Purposes Processing is necessary for Archiving and Research Purposes in accordance with Applicable Law. |
ADHICS v2 ICT Law |
| 13. | Clinical Photography & Videography for Medical, Educational, and Research Purposes. | We may capture images/videos to track your recovery, evaluate your treatment, communicate with other healthcare professionals involved in your treatment, and use them for educational purposes, research, and publications, with your consent. Your identity will be protected where possible, and you may withdraw or modify your consent at any time. Consent is valid for 30 days from the date of signature and applies to future use; however, withdrawal will not affect images/videos already used. | Your Consent We will obtain your consent before using your personal data for any clinical photography & videography. |
Explicit consent You can withdraw your consent at any time by contacting your treating doctor or by providing their name to [email protected]. |
ADHICS v2 ICT Law |
| 14. | Clinical referrals | To provide you with comprehensive and high-quality health care, it may be necessary to refer your clinical case to other healthcare professionals at other facilities within the NMC Healthcare Group. In rare instances, it may also be necessary to refer your case outside of our network.Clinical referrals. | Contract We need to process your health information to perform our healthcare contract with you and fulfil your request. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 Or Processing is necessary to protect the data subject interests. ICT Law |
| 15. | Patient transfer | To continue your treatment, we may need to transfer you to another health care facility in the country. As part of this process, we may share necessary medical and identification details with the receiving hospital and any relevant government platforms (e.g. Estijabah). | Contract We need to process your personal and health information to fulfil our contract with you and transfer you to another facility where you can continue your treatment |
Health Purposes Processing is necessary for health purposes. |
ADHICS v2 ICT Law |
| 16. | Patient transfer at your request | To continue your treatment at another facility or in another country at your request. | Contract We need to process your personal and health information to fulfil the contract with you and transfer you to another facility where you can continue the treatment |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 17. | Patient transfer when there is insufficient insurance coverage or where your treatment cannot be continued at our facility | We may use external vendors to provide cloud-based video interviewing, assessment, and scheduling services. NMC Healthcare Group currently has currently engaged HireVue Inc. to provide these services. You can learn more about them by reading their privacy policy. | To protect your life, we may need to transfer you to another healthcare facility outside the country. By doing so we have to communicate your personal and health data to third parties. | Vital Interests Processing is necessary to protect vital interests of the Data Subject or of another natural person where the Data Subject is physically or legally incapable of giving Consent |
ADHICS v2 ICT Law |
| 18. | Data Sharing with Next of Kin | During the registration process, you (or your legally authorised representative, where applicable) may designate family members or other close individuals to whom you wish to authorise the release of your medical information. These individuals will be allowed to request and inquire about your medical records and health status. |
Consent You can withdraw your consent at any time. Please see Section Your Rights, Right to Withdraw Your Consent for more information. |
Explicit consent You can withdraw your consent at any time. Please see Section Your Rights, Right to Withdraw Your Consent for more information. |
ADHICS v2 ICT Law |
| 19. | Providing improved quality services | We take measures to continually improve the quality of the services we provide. This includes monitoring or recording telephone calls to our contact numbers for training and security purposes and conducting pre and post treatment surveys. |
Legitimate Interests Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Right to Object to the processing of your personal information for more details. Consent You can withdraw your consent at any time. Please see Section Your Rights, Right to Withdraw Your Consent for more information. |
Public Interests Explicit Consent |
ADHICS v2 For pre and post treatment surveys, we collect data with consent. ICT Law For pre and post treatment surveys, we collect data with consent. |
| 20. | Data Management and Reporting for Healthcare Operations Improvement | We may process your data to improve how we manage appointments, reducing inefficiencies, and ensure timely follow-ups, all aimed at providing better care and enhancing your healthcare experience. |
Legitimate Interests Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Your Rights, Right to Object to the Processing of Your Personal Information for more details. |
Public Interests Processing is necessary for reasons of public interest in public health, such as protecting against serious threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices. |
ADHICS v2 ICT Law |
| 21. | Recruiting new staff | We will process your personal data if you apply for a job at NMC Healthcare Group. This includes all phases of the recruitment process including shortlisting, assessment, and interview, and offers of a position made to successful candidates. | Contract We need to process your personal data to take steps to enter into a contract of employment with you. |
UAE PDPL The Processing is necessary to perform a contract to which the Data Subject is a party or to take, at the request of the Data Subject, procedures for concluding, amending, or terminating a contract. |
|
| 22. | Recruiting new staff: processing your application | We may use external vendors to provide cloud-based video interviewing, assessment, and scheduling services. NMC Healthcare Group has currently engaged HireVue Inc. to provide these services. You can learn more about them by reading their privacy policy. |
Legitimate Interests Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Right to Object to the Processing of Your Personal Information for more details. |
UAE PDPL The Processing is necessary to perform a contract to which the Data Subject is a party or to take, at the request of the Data Subject, procedures for concluding, amending, or terminating a contract. |
|
| 23. | Vetting and onboarding new business partners and vendors | Before engaging with new suppliers, vendors, or business partners, it is NMC Healthcare Group’s policy to conduct appropriate due diligence to ensure that we know who we are doing business with. These checks may require us to process personal data belonging to board directors, officers or other employees of these companies or organisations. |
Legitimate Interests Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Right to Object to the Processing of Your Personal Information for more details. |
UAE PDPL The Processing is necessary to protect the public interest. As healthcare providers, we are responsible for ensuring that our operations align with public health standards. |
|
| 24. | Marketing | We may use your personal data to share information aimed at promoting health awareness, as well as inform you about our services and products. This may include contact information you have given us to contact you by phone, by email, SMS, or other messaging platform you agree to. | Consent We will only contact you if you consent to us doing so and have not withdrawn that consent. You can withdraw your consent at any time. Please see Section Your Rights, Right to Object to How We Use Your Personal Information for Direct Marketing Purposes and the Right to Withdraw Your Consent for more information. |
Explicit consent You can withdraw your consent at any time. Please see Section Your Rights, Right to Object to How We Use Your Personal Information for Direct Marketing Purposes and the Right to Withdraw Your Consent for more information. |
ADHICS v2 ICT Law |
| 25. | Requests from Law Enforcement and Government Authorities | There may be times when we are required to provide the personal data of our patients or employees to law enforcement agencies such as the police, public health authorities or other government entities. We will cooperate with these agencies when we receive such requests. | Legal Obligation In these situations, we are compelled to process your personal data to comply with a legal obligation to which we are subject. |
Legal Obligation The exercise of a function or requirement conferred on a person by Applicable Law. |
ADHICS v2 ICT Law UAE PDPL |
| 26. | Appointment bookings | In order for us to book your appointment we must process your personal and health information. |
Contract You are required to provide personal data in order to enter or perform our contract with you. If you do not provide us with your personal data, we will be unable to perform our contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 27. | Processing for financial and operational efficiency and compliance | Analysis of financial results, internal and external audit requirements, receiving professional advice (e.g., tax, financial, legal, or public relations advice) to support business efficiency and compliance. |
Legitimate Interests Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Your Rights, Right to Object to the Processing of Your Personal Information for more details. |
Public Interest Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices. |
ADHICS v2 ICT Law |
| 28. | CCTV Recordings | Storing and reviewing CCTV images is necessary to maintain our facilities safe. | Legal Obligation To comply with our legal and regulatory obligations to maintain safe and secure premises for visitors to our premises and our employees. |
ADHICS v2 ICT Law UAE PDPL |
|
| 29. | Managing our accounting records | We need to maintain our accounting records. | Legal Obligation To comply with relevant financial accounting and tax requirements. |
ADHICS v2 ICT Law |
|
| 30. | Debt recovery and management | In the event of overdue or unpaid invoices, your personal data may be processed for debt collection purposes. This may include sharing relevant details such as contact information, the amount owed, and invoice numbers with third-party debt collection agencies or legal representatives to recover outstanding payments. | Contract The processing of your personal data is necessary to perform our contract with you, particularly in relation to unpaid invoices and the recovery of outstanding payments. |
ADHICS v2 ICT Law |
|
| 31. | Keeping your records | We need to keep your medical records to comply with relevant laws. |
Legal Obligation To comply with laws regulating the duration of storage of medical records. |
Legal Obligation The exercise of a function or requirement conferred on a person by Applicable Law |
ADHICS v2 ICT Law |
| 32. | Accessing Your Medical Records | You or your legally authorised representative can request medical records in person or by email. | Contract We need to process your personal and health information to fulfil our contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 33. | Incident Reporting | You can always reach out to NMC and report a complaint |
Legitimate Interest Please note that you have the right to object to processing based on legitimate interest. Please see Section Your Rights, Your Rights, Right to Object to the Processing of Your Personal Information for more details. |
Public Interest Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices. |
ADHICS v2 ICT Law |
| 34. | Communicating with embassies and agencies about your treatment | Sometimes NMC Group Services will need to communicate with your home country’s embassy or an agency about your treatment. | Contract We need to process your personal and health data to enter a contract with you. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract. |
ADHICS v2 ICT Law |
| 35. | Occupational health | We need to process your personal information in order to assess your work capacity, whether you can perform the specific work or perform other employment related health service. | Contract We need to process your personal and health data to perform our healthcare contract with you and provide you with requested services. |
Health Purposes Processing is necessary for health purposes, including preventative or occupational medicine, the assessment of the working capacity of an employee, medical diagnosis, the provision of health care or treatment or the management of health care systems or services or pursuant to a contract with a health professional provided that Processing is by or under the responsibility of a health professional subject to the obligation of professional secrecy or duty of confidentiality. |
ADHICS v2 ICT Law |
| 36. | Sharing your data with the Health Information Exchange System NABIDH in Dubai | We share your personal and health information with the NABIDH as part of our contractual obligation to provide you with healthcare services. This ensures that all healthcare providers involved in your treatment can access your information to provide coordinated care. |
Contract If you wish to opt out of this data sharing, you can contact [email protected]. If you are a current patient, you can also contact the reception of your healthcare facility to opt-out. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering a contract. |
ICT Law Necessary for the provision of healthcare services. |
| 37. | Sharing your data with Riayati Health Information Exchange in Northern Emirates (Sharjah, Ras Al Khaimah, Umm Al Quwain, Fujairah). | We share your personal and health information with Riayati as part of our contractual obligation to provide you with healthcare services. This ensures that all healthcare providers involved in your treatment can access your information to provide coordinated care. |
Contract If you wish to opt out of this data sharing, you can contact your treating doctor. |
Performance of Contract Processing is required for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering a contract. |
ICT Law Necessary for the provision of healthcare services. |
| 38. | Sharing your data with Abu Dhabi Health Information Exchange (Malaffi) | We are required by the Department of Health – Abu Dhabi (DOH) to share your personal and health information with Malaffi in accordance with applicable laws and regulations. This ensures that healthcare providers involved in your treatment have access to your information for coordinated and effective care. While patient consent is generally required for this data sharing, DOH policy also mandates the exchange of patient data in certain cases, even if consent is unavailable (such as personal data obtained by us before the DOH mandated this data transfer). |
Legal Obligation
|
Legal Obligation The exercise of a function or requirement conferred on a person by Applicable Law. |
ADHICS v2 ICT Law |
We will do our best let you know in advance what will happen to your personal data. We will not use your personal data for a purpose that is materially different from the purposes listed in this Privacy Statement. In order to assess whether the new purpose(s) are materially different we will carry out a so-called compatibility test to assess whether the new purposes is compatible with the old one and inform you of the new purpose.
We may share your personal data with third parties to provide you with the best healthcare services and experiences possible, to run our business more efficiently, or to comply with the law. These entities might be other healthcare providers, laboratories, service providers such as technology or manpower providers, government agencies, authorities, and regulatory bodies. These may also include embassies, insurance companies, your employers, organisations that help us run our business such as consultancy firms, talent acquisition agencies, entities within NMC group and similar. These third parties may be independent or joint data controllers or processors with whom we share your personal data for the following reasons:
to:
to:
to:
Before transferring your personal data to any third party, we will carry out proper due diligence and, where required, we will ensure that we enter into an appropriate agreement with them. The agreement will clearly set out the respective roles of each Controller to the agreement or will instruct Data Processors on the purposes for which they can process the personal data, as well as the standards they must adhere to.
Where we transfer personal data to another jurisdiction, we use appropriate safeguards such as standard contractual clauses adopted by the ADGM Commissioner of Data Protection. However, this will not be necessary if:
We follow all applicable laws governing the retention of your data and will not keep it in an identifiable format for longer than reasonably necessary.
We retain the data we collect from you for different periods depending what is required by law, on your preferences, where applicable, and the purposes we use it for. The personal data that we retain falls into the following categories:
You may have certain legal rights regarding your personal information depending upon the jurisdiction in which you are located or how we interact with you. You can exercise your rights by sending an email to the NMC Healthcare Group Data Protection Officer at [email protected]. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information to fulfil your request.
You can learn more about these rights here.
Subject to the terms of this Privacy Statement you have the right to:
You have the right to request that we provide you with a copy of your personal information that we hold, and you have the right to be informed of,
the existence of automated decision-making, including profiling and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject.
We will receive and handle your complaints in accordance with best practice and depending on where you are and whether we are subject to it, any applicable law.
You have the right to ask us to rectify inaccurate personal information we have collected from you where it is technically feasible for us to do so. In so doing, we may however take steps verify the accuracy of the personal information before rectifying it.
You can also ask us to erase your personal information in limited circumstances where:
You can ask us to restrict your personal information, but only where:
We can continue to use your personal information following a request for restriction, where:
You can ask us to give your personal information to you in a structured, commonly used, machine-readable format. You can also ask to have it transferred directly to another data controller, but in each case only where:
You can object to any processing, including profiling, of your personal information which has our legitimate interests as its legal basis if you believe your fundamental rights and freedoms outweigh our legitimate interests. This can be done at any time.
If you raise an objection, we have the option to demonstrate that we have compelling legitimate interests which override your rights and freedoms or that processing is necessary for the establishment, exercise, or defence of legal claims. Where we cannot do this, we will cease to process your personal data.
Where your personal Data is Processed for archiving and research purposes, you have the right to object to having your personal data processed, unless it is necessary to perform a task we are carrying out for reasons of public interest.
You can request that we change the way we contact you for marketing purposes. See Right to withdraw consent Section for more information on withdrawing consent.
You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.
You can withdraw your consent at any time or modify your consent where applicable. The withdrawal or modification of Consent will not affect the lawfulness of processing based on consent before it was withdrawn or modified.
You can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the ADGM or for any other restricted transfer. We may redact data transfer agreements to protect commercial terms.
Where your personal data is processed by a member of NMC Healthcare Group that is registered within the ADGM, you also have the right to lodge any complaints or concerns regarding the use of their personal data with the ADGM Commissioner for Data Protection (both health and non-health personal data) the local data protection authority at [email protected]
Where you decide to exercise any of these rights, we may request additional information from you to help us verify your identity or to confirm that you have given authority to another person to exercise these rights on your behalf.
We do however reserve the right not to restrict access to your information or to limit your rights (e.g., if such disclosure is prohibited by law or if the rights of another individual might be violated). In some instances, this may mean that we are able to retain your personal data even if you withdraw your consent. Please contact the Data Protection Officer at [email protected] for more information about your rights or to exercise any of them.
If there is a conflict between this Privacy Statement and an applicable law, applicable law will apply to you. We will determine whether there is a conflict, so you do not have to.
We will not make any decision, policy, or assessment that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
Your main point of contact for all issues arising from the use of your personal data, is the NMC Healthcare Group Data Protection Officer. The Data Protection Officer can be contacted in the following ways:
The Data Protection Officer,
NMC Group Services LTD.
16th Floor,
Al Maryah Tower,
Abu Dhabi Global Market Square, Al Maryah Island
Abu Dhabi, UAE.
If you have any questions, concerns, or complaints regarding our compliance with this Privacy Statement and the data protection laws, or if you wish to exercise your rights, we encourage you to first contact us. We will investigate and attempt to resolve complaints and disputes and will make every reasonable effort to honour your wish to exercise your rights as quickly as possible and, in any event, within the timescales provided by data protection laws.
We do not knowingly collect personal data online directly from individuals under the age of 18 years. Adults who interact with NMC Healthcare Group should ensure that they have proper authority to transfer personal data belonging to children to NMC Healthcare Group (under 18 years). This means that the adult must either be the parent of the child in question or the legally recognised guardian.
We will transfer your personal data to other entities within the NMC Healthcare Group where necessary.
If you are a patient, the facility where you had your initial consultation, we may share your personal data (including health data) with other NMC Healthcare Group facilities in certain circumstances and for specific purposes that are related to the delivery of health care services to you. These may include:
In most cases, your data will be accessed by the corresponding health provider through NMC Healthcare Group’s Health Information system. Both will be Joint Controllers with joint responsibility for processing your data. NMC Group Services is a joint Controller for all the processing activities, outlined in section on ‘How we Use Your Personal Data’ above. NMC Group Services will be responsible for facilitating the exercise of Data Subjects’ rights and will serve as a primary point of contact.
“Personal data”, “personal information”, or “PII” means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly — in particular, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural, or social identity.
“Special Categories of Personal Data” refers to personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and the processing of data concerning health or sexual orientation.
“Sensitive personal data” either indicates “special categories” (see above) or is personal data of which the sensitivity level has been assessed and classified, indicating potential severe impact on an individual when confidentiality of such data is breached.
“Anonymised” is the deletion or changing of personal data in such a way that it can no longer be foreseeably assigned to a certain or ascertainable individual or only with a disproportionately high effort in terms of time, cost, and work.
“Consent” is any freely given, specific and transparently, unambiguous, well-informed indication of the will of the individual, whereby the individual agrees that his or her personal data may be processed. Particular requirements about consent can arise from the respective national laws. Where possible, consent is obtained in an explicit manner (unambiguously).
“NMC Healthcare Group” means, NMC OpCo Ltd and its subsidiaries. Click here for a detailed listing.
“NMC Healthcare Facility” means, a facility that is providing healthcare services such a hospital, clinic and similar.
NMC Healthcare Group comprises the following companies
| Company Name | Company Number | Country |
|---|---|---|
| Bait Al Shifaa Pharmacy Ltd | 000004236 | UAE |
| Grand Hamad Pharmacy Ltd | 000004238 | UAE |
| Hamad Pharmacy Ltd | 000004209 | UAE |
| NMC Provita International Medical Centre Ltd | 000004240 | UAE |
| N M C Royal Hospital LTD | 000004225 | UAE |
| N M C Royal Hospital LTD | 000004245 | UAE |
| N M C Royal Medical Centre LTD | 000004197 | UAE |
| N M C Speciality Hospital LTD | 000004217 | UAE |
| N M C Speciality Hospital LTD | 000004241 | UAE |
| New Medical Centre Ltd | 000004214 | UAE |
| New Medical Centre Ltd | 000004216 | UAE |
| New Medical Centre Pharmacy Ltd | 000004253 | UAE |
| New Medical Centre Pharmacy Ltd | 000004255 | UAE |
| New Medical Centre Speciality Hospital Ltd | 000004228 | UAE |
| New Medical Centre Trading Ltd | 000004218 | UAE |
| New Pharmacy Company Ltd | 000004230 | UAE |
| New Sunny Medical Centre Ltd | 000004202 | UAE |
| NMC Assetco Limited | 000006769 | UAE |
| NMC Group Services LTD | 18803 | UAE |
| NMC Healthcare Ltd (In Administration) | 000004210 | UAE |
| NMC Holdco SPV Ltd | 000005914 | UAE |
| NMC Holding LTD (In Administration) | 000004211 | UAE |
| NMC Newco SPV Limited | 000006553 | UAE |
| NMC Opco Ltd | 000005918 | UAE |
| NMC Royal Family Medical Centre Ltd | 000004243 | UAE |
| NMC Royal Hospital LTD | 000004237 | UAE |
| NMC Royal Women’s Hospital Ltd | 000004235 | UAE |
| Reliance Information Technology Ltd | 000004234 | UAE |
| Sharjah Pharmacy Ltd | 000004239 | UAE |
| Sunny Al Buhairah Medical Centre Ltd | 000004199 | UAE |
| Sunny Al Nahda Medical Centre Ltd | 000004232 | UAE |
| Sunny Dental Centre Ltd | 000004198 | UAE |
| Sunny Halwan Speciality Medical Centre Ltd | 000004204 | UAE |
| Sunny Maysloon Speciality Medical Centre Ltd | 000004205 | UAE |
| Sunny Medical Centre Ltd | 000004231 | UAE |
| Sunny Sharqan Medical Centre Ltd | 000004203 | UAE |
| Sunny Specialty Medical Centre Ltd | 000004200 | UAE |
| Company Name | Company Number | Country |
|---|---|---|
| Al Seha Al Kubra Pharmacy LLC | 742464 | UAE |
| Alpha Care Pharmacy LLC | CN-2202520 | UAE |
| Alpha Medical Centre LLC | CN-1034169 | UAE |
| Amala Medical Centre LLC | 635023 | UAE |
| Americare LLC | CN-1514123 | UAE |
| Bareen International Hospital | CN-1471391 | UAE |
| Bareen Pharmacy | CN-1472890 | UAE |
| Bright Point Pharmacy LLC | CN-1795337 | UAE |
| CBD NMC Commercial Brokers LLC | CN-4229748 | UAE |
| Centurion Medical Facilities Management Group LLC | CN-2182569 | UAE |
| Cosmesurge & Emirates Clinics for One Day Surgery LLC | CN-1045650 | UAE |
| Cosmesurge Clinics LLC, Conrad | 509266 | UAE |
| Cosmesurge Investment LLC | 801368 | UAE |
| Cosmesurge Plastic Surgery Hospital And Clinics L.L.C | 785984 | UAE |
| Cosmesurge Zakher Medical Centre LLC | CN-2108872 | UAE |
| Cytomed Middle East LLC | 525053 | UAE |
| Fajar Alsatwa Pharmacy LLC | 797745 | UAE |
| Golden Sands Medical Centre LLC | CN-1023217 | UAE |
| Hamad Al Ihterafeya Pharmacy L.L.C | 751424 | UAE |
| Hamad Al Mumayazah Pharmacy LLC | 744681 | UAE |
| Hamad Al Oula Pharmacy LLC | 747559 | UAE |
| Lotus Pharmacy LLC | CN-1766692 | UAE |
| Mesk Al Madina Medical Centre L.L.C | CN-1778982 | UAE |
| NMC Medical Professional Training Centre LLC | CN-2417299 | UAE |
| NMC Pharmacy L.L.C.- OPC | CN-1100258 | UAE |
| NMC Real Estate-Sole Proprietorship LLC | CN-2278435 | UAE |
| NMC Real Estate Management L.L.C. | 1383731 | UAE |
| NMC Royal Dental Centre Opc (Rak) | 38678 | UAE |
| NMC Royal First Aid Clinic LLC | CN-2391784 | UAE |
| NMC Royal Medical Centre | 21518 | UAE |
| NMC Royal Pharmacy LLC OPC | 21669 | UAE |
| NMC Wholesale Drug Store And Supplies L.L.C. | CN-4825376 | UAE |
| Oxford Medical Centre LLC | CN-1079694 | UAE |
| Oxford Pharmacy LLC | CN-1087009 | UAE |
| Poly Clinic Aesthetic Dermatology Plastic Surgery Dental LLC | CN-1027668 | UAE |
| Reaya Mumayaza Specialized for Medical Home Care LLC | CN-2157940 | UAE |
| Royal Arsom Wellness Centre LLC | CN-2217742 | UAE |
| Sands Pharmacy LLC | CN-1024388 | UAE |
| The American Surgecenter LLC | CN-1074061 | UAE |
| The American Surgecenter Pharmacy LLC | CN-1077415 | UAE |
| Zanbaq Al Madina Pharmacy L.L.C | CN-2030045 | UAE |
| Elegant Medical Centre | 1668137 | Oman |
© Copyright 2026 NMC Healthcare. All Rights Reserved. MOH License No - IRL1J3AD
