Privacy Policy

Who we are

Offpeek Ltd is a company registered in the Dubai International Financial Centre, registration number [•], with its registered office at [Unit •, Level •, Building], Dubai International Financial Centre, Dubai, United Arab Emirates.

Our Data Protection Officer can be reached at dpo@offpeek.ae. General privacy questions go to privacy@offpeek.ae.

The law that applies to us

Three regimes apply to us at once, and they do not overlap neatly.

The DIFC Data Protection Law covers all of our processing, wherever it happens, because we are registered in the DIFC.

UAE Federal Law No. 2 of 2019 on the use of technology in health covers all booking data belonging to businesses licensed by a UAE health regulator. That law applies across the whole country, including the free zones, so our DIFC registration gives us no exemption from it.

The UAE Federal Personal Data Protection Law does not generally apply to us, because it excludes free-zone companies that have their own data protection law and excludes health data regulated by other legislation.

The practical effect: a clinic's booking data sits under the UAE health data law, while our own corporate, staff and prospect data sits under the DIFC regime. Where a business is not health-regulated, the DIFC regime governs our handling of its booking data.

When we are a processor, and when we are a controller

We are a processor — acting on the business's instructions — for booking, appointment and customer records exported by a merchant, and for the contact details and message history used to run a recovery campaign. The merchant is the controller.

We are a controller for merchant account, contact and billing records, for security, fraud-prevention and service logs, and for our own marketing to businesses and our website visitors.

Aggregated, de-identified measurement outputs are not personal data at all.

Where we act as a processor, the merchant is responsible for having a lawful basis to hold the customer records they send us and for the notices given to those customers.

If you are a customer of one of our merchants and want to exercise a right over your data, contact that merchant. You can also write to privacy@offpeek.ae and we will pass your request on and help them respond.

What we collect

From merchants. Account and profile data — business name, trade licence details, locations, contacts, roles and credentials. Booking data — appointments, slots, services, durations, staff assignment, prices, utilisation, cancellations, no-shows and the timestamps around them. Customer records — name, mobile number, email where held, booking history, frequency, spend band, no-show and cancellation history, lapse status, and message and consent history. Integration data — connection tokens and metadata for a merchant's booking platform, point of sale, practice-management system or calendar. Billing data — invoices, payment status and the measurement records behind them; we do not collect or store card numbers. Support and diagnostic data — tickets, correspondence, error reports and service logs.

Connected calendar data. Where a merchant uses our booking layer, we read busy and free periods, appointment times, durations and staff assignment from the connected calendar, so we can show accurate availability and prevent double bookings. We read what we need to know whether a slot is free. We do not need, and do not use, the content of unrelated calendar entries.

From merchants' customers, through the merchant. Contact details, booking and attendance history, message delivery and response events, and opt-in and opt-out records.

From website visitors. Device and browser data, pages viewed, referral source, and the cookie data described in our Cookie Policy.

What we do not collect. We do not want clinical records, diagnostic images, laboratory results, prescriptions or treatment notes, and our merchant terms prohibit sending them to us. If clinical content reaches us by mistake, we delete it and tell the merchant.

Why we process it

To provide the service to a merchant — the leak audit, slot scoring, recovery campaigns, measurement and reporting — on the basis of our contract with them. In respect of their customers, we act as processor on their basis.

To operate the booking layer — taking bookings, reading and writing the connected calendar, and preventing double bookings.

To send recovery and reactivation messages to a merchant's customers, on the consent record the merchant holds.

To run randomly selected hold-out groups to measure lift, on the basis of our legitimate interests. Accurate measurement is the basis on which the merchant is charged, and it is what stops us over-billing them.

To suppress customers who should not be contacted, on the basis of our legitimate interests and any objection the individual has made.

For billing, collections and financial record keeping; for security, fraud prevention and service integrity; to improve the service using aggregated, de-identified data; and to market our own services to businesses, with an opt-out in every message.

Where a merchant is licensed by a UAE health regulator, UAE law requires written patient approval before health information is used for anything that is not a health purpose. Marketing is not a health purpose. The merchant must obtain that approval before we will run a campaign.

Automated processing, scoring and AI

Our models score capacity — which hour is likely to go unsold, which booked slot is at risk of a no-show, which cancelled slot can be refilled. They also score whether contacting a customer is likely to change anything, so we can leave alone the people who were coming anyway.

Our models do not decide whether a person receives treatment, is admitted, is charged more, is granted credit, or is refused a service. Pricing decisions belong to the merchant.

Here is what goes in: historic booking and attendance patterns for the slot and the practitioner; day of week and time of day; how far ahead a booking was made; the customer's own booking frequency, recency and past attendance with that merchant; the service type and its typical duration and price band; and the local calendar. Nothing else. Health data is never a scoring feature, and neither is data from any other merchant.

What comes out is a ranking of slots by how likely they are to go unsold and be recoverable, and a signal that contacting a particular person is unlikely to change their behaviour. The consequence for an individual is whether they receive a message, and whether a slot is offered at a reduced price. Nothing about their access to the service or the terms on which they can book.

We maintain a data protection impact assessment, a register of AI processing activities, documented bias-mitigation measures, and an Autonomous Systems Officer. Our systems operate within purposes defined by people and cannot change the principles they are built on.

Where a decision is based solely on automated processing and has legal or similarly significant consequences for you, you can object and require a human to review it. We honour that, and we treat borderline cases as engaging the right rather than arguing about the threshold. We do not rely on any exception to this where the person is a minor.

We do not use merchant data or customer personal data to train or improve any AI model made available to or operated by a third party.

Who we share it with

Cloud hosting and database services, to run the service. All merchant booking data is hosted in a United Arab Emirates region, and health information does not leave the UAE.

Messaging providers, including the WhatsApp Business Platform and SMS aggregators, to deliver the messages a merchant instructs us to send.

Error monitoring and product analytics providers, for reliability and diagnostics, configured to exclude booking and customer records.

A transactional email provider, for account and billing notices to merchants — merchant contacts only, no end-customer data.

Professional advisers, auditors and insurers where needed. A regulator, court or public authority where legally required. An acquirer, on a merger or sale of the business, subject to equivalent protections.

A current list of our sub-processors, with their locations and the data they handle, is published at offpeek.ae/legal/sub-processors. We give merchants at least thirty days' notice of a material change and a chance to object.

Where a public authority asks us for personal data, we assess whether the request is valid and proportionate, and where we lawfully can, we tell the merchant before we respond.

We do not sell personal data. We do not rent, license or broker it, and we do not share one merchant's customer records with another.

Where data is held

Health information stays in the United Arab Emirates. UAE law prohibits storing, processing or transforming health data outside the country. We host all booking data belonging to health-regulated merchants in a UAE region, and we do not permit access to it from outside the UAE — not for support, not for engineering, not for model training. Remote access from abroad is a transfer, and we treat it as one.

For other personal data, we transfer outside the DIFC only where the destination is on the list of adequate jurisdictions published by the Commissioner of Data Protection, or where an approved safeguard is in place, or where a specific exception applies. We assess and document the destination and the recipient before each category of transfer.

How long we keep it

We do not delete data automatically when a contract ends. We retain by data type, and we delete on request where the law allows.

Health information generated in the UAE is kept for at least twenty-five years from the last health procedure, because UAE law requires it. A deletion request cannot override that.

Merchant booking and customer records that are not health data are kept for the term of the contract, then twenty-four months, unless the merchant asks for earlier deletion or the law requires longer. Marketing consent and opt-out records are kept while the consent is relied on and for five years after it is withdrawn, as evidence; cookie consent records are kept for twelve months. Measurement records supporting an invoice, and invoices and financial records, are kept for seven years. Merchant account records are kept for the term plus twenty-four months. Service logs are kept for ninety days, and error monitoring records for thirty to ninety days. Superseded model versions are kept for up to twelve months.

Aggregated, de-identified measurement outputs are kept indefinitely. That is not personal data.

Backups are purged on the ordinary backup cycle, which can take up to ninety days after deletion from live systems. Where a merchant asks us to delete data, we do so within thirty days, except where we must keep it by law, to defend a legal claim, or to support an invoice already issued.

Your rights

You can withdraw consent where we rely on it; withdrawal is not retrospective. You can ask what we hold, have it corrected, or ask us to erase it. You can object to processing based on our legitimate interests, including profiling. You can ask us to pause processing while a dispute is resolved. You can receive your data in a structured, commonly used, machine-readable format. And you can object to a decision based solely on automated processing with legal or similarly significant consequences, and require a human review.

To exercise a right, email privacy@offpeek.ae. If your data reached us through a merchant, we will refer you to that merchant, who is the controller, and support them in responding. We answer within one month.

You can opt out of marketing at any time. Every message we send on a merchant's behalf carries a one-tap opt-out, and we honour it across every campaign for that merchant.

How we protect it

Encryption in transit using TLS 1.2 or above, and at rest using AES-256. Role-based access on a least-privilege basis, unique named accounts, and multi-factor authentication for administrative and remote access. Row-level separation so no merchant's data is reachable from another merchant's session. Audit logging of access to customer records, kept for at least twelve months. Segregated environments, with live personal data never used in development or testing. Vulnerability scanning, dependency monitoring, a documented patching cadence and annual independent penetration testing. Background-checked staff, written confidentiality undertakings, and training before access and every year after. Access revoked promptly when someone changes role or leaves.

If a data breach compromises the security or privacy of personal data, we notify the Commissioner of Data Protection as soon as practicable, and affected individuals where the risk is high. Where we act as a processor, we notify the merchant without undue delay after confirming a breach and in any event within seventy-two hours — or within twenty-four hours where health data is affected.

Children

The service is for businesses. We do not knowingly process a child's data except where a merchant's customer record concerns a minor patient or client, in which case the merchant is responsible for the consents required. We do not send marketing messages to a record identified as a minor.

Complaints, changes and contact

Complain to us at privacy@offpeek.ae. You can also complain to the DIFC Commissioner of Data Protection at commissioner@dp.difc.ae, and you can bring a claim directly in the DIFC Courts for material or non-material damage, including distress.

We may update this policy. Where a change materially affects how we process personal data, we give at least thirty days' notice by email to merchant account contacts and by posting the new version with a new date.