Privacy Policy

1. Introduction

Welcome to myBwell. MyBwell FZ-LLC ("MyBwell", "we", "our", or "us"), a free zone limited liability company registered at HD15A, 1st Floor, In5 Tech, Dubai Internet City, Dubai, UAE, operates the myBwell mobile application and any associated digital services (collectively, the "Services").

myBwell is a healthcare access membership platform that provides members with curated discounts on healthcare and wellness services through a network of providers across the UAE and, for VIP members, internationally.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, with whom we share it, and the rights available to you under applicable law, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and its implementing regulations.

By downloading, registering for, or using the myBwell application, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use our Services.

2. Data Controller

The data controller responsible for your personal data is:

For any questions, complaints, or requests relating to your personal data, please contact our Privacy Officer at the email address above. We aim to respond to all requests within 30 days.

3. Personal Data We Collect

We collect only the personal data necessary to provide and improve our Services.

3.1 Data You Provide Directly

• Full name — to create and personalise your myBwell account.
• Email address — to send account communications, confirmations, and service updates.
• Phone number — for account verification and, if elected, service notifications.
• Date of birth — to verify eligibility for membership tiers and age-appropriate services.
• Membership tier selection — Select (AED 399), Premium (AED 699), Premium Family (AED 999), or VIP (AED 1,499) per year.

3.2 Data Collected Automatically

• Precise or approximate location data — collected when you search for nearby network providers. You can disable location permissions in your device settings; doing so may limit functionality.
• Device information — device type, operating system version, and unique device identifiers, used to ensure app compatibility and diagnose technical issues.
• Usage data — pages viewed, features accessed, search queries, and session duration, collected via analytics tools to improve the user experience.
• Crash and diagnostics data — error logs and performance data collected automatically if the app encounters an issue.

3.3 Data We Do Not Collect

We do not directly collect or store:

• Payment card details or bank account information (payments are processed by third-party payment processors operating under their own privacy policies).
• Sensitive health or medical records. You may search for health-related providers within the app, but we do not collect or store clinical information about you.

4. How We Use Your Personal Data

We process your personal data for the following purposes and on the following legal bases under the UAE PDPL:

Where we rely on your consent as the legal basis (e.g., marketing emails), you have the right to withdraw that consent at any time by contacting us at support@mybwell.com or using the unsubscribe link in any marketing communication.

5. Sharing Your Personal Data

We do not sell your personal data. We share it only as described below, and only to the extent necessary for each purpose.

5.1 Network Service Providers (Offer Redemption & Store Purchases)

When you redeem an offer or purchase a product or service through the myBwell app, limited data (such as your name and membership tier) may be shared with the relevant provider in our network to facilitate the transaction and verify your eligibility. These providers are contractually bound to use your data only for this purpose.

5.2 Analytics Service Providers

We use third-party analytics platforms (such as Firebase or equivalent services) to understand how users interact with our app. These providers process usage data, device information, and crash logs on our behalf under data processing agreements. They are not permitted to use this data for their own independent purposes.

5.3 Payment Processors

Membership subscription payments are handled by third-party payment processors. We do not receive or store your full card details. Payment processors are independently responsible for the security of your financial data under their own privacy policies and applicable financial regulation.

5.4 Legal and Regulatory Disclosure

We may disclose personal data to courts, regulators, law enforcement, or government authorities where required to do so by applicable UAE law, court order, or to protect the rights, property, or safety of MyBwell, our users, or others.

5.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction. We will notify you via email or a prominent in-app notice before your data becomes subject to a materially different privacy policy.

6. International Data Transfers

Some of our third-party service providers (including analytics platforms) may process data outside the UAE. Where such transfers occur, we ensure they are subject to appropriate safeguards, which may include:

• Standard contractual clauses approved by the UAE Data Office;
• Transfers to countries recognised by the UAE as providing an adequate level of data protection; or
• Other legally recognised transfer mechanisms under the UAE PDPL.

VIP members who use the Medical Travel Concierge may have booking-related information shared with providers in the relevant destination country, strictly for the purpose of arranging medical travel services across 2,300+ providers in 58 countries.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy, or as required by UAE law.

When your data is no longer required, we securely delete or anonymise it so that it can no longer be associated with you.

8. Your Rights

Under UAE Federal Decree-Law No. 45 of 2021 (PDPL), you have the following rights regarding your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate or incomplete data.
• Right to erasure — you may request deletion of your data where there is no legitimate reason for us to continue processing it.
• Right to restriction — you may ask us to restrict processing of your data in certain circumstances (e.g., while a dispute is resolved).
• Right to data portability — you may request your data in a commonly used, machine-readable format.
• Right to object — you may object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@mybwell.com. We will respond within 30 days. In complex cases, we may extend this by a further 30 days and will notify you accordingly. We may need to verify your identity before processing your request.

If you are dissatisfied with our response, you have the right to lodge a complaint with the UAE Data Office (the competent supervisory authority under the PDPL).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest on our servers.
• Access controls limiting data access to authorised personnel on a need-to-know basis.
• Regular security assessments and vulnerability testing.
• Staff training on data protection obligations.

No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security. In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you and the UAE Data Office as required by law.

10. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at support@mybwell.com and we will promptly delete such information.

11. Cookies and Tracking Technologies

Our mobile application may use cookies, SDKs, and similar tracking technologies (collectively, "Tracking Technologies") to enable core functionality and analyse usage.

• Essential technologies — required for the app to function (e.g., session management, authentication tokens). These cannot be disabled without ceasing use of the app.
• Analytics technologies — used to collect aggregated usage statistics. You may opt out by adjusting your device settings or contacting us.

We do not use Tracking Technologies for targeted advertising and we do not sell data to advertising networks.

12. Third-Party Services and Links

The myBwell app may display links to, or integrate with, third-party provider websites or booking platforms. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through the app. We are not responsible for the privacy practices of third parties.

13. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Effective Date" at the top of this document;
• Post the revised Policy in the app; and
• Notify you by email or via an in-app notification at least 14 days before the changes take effect.

Your continued use of the Services after the effective date of any updates constitutes your acceptance of the revised Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer:

We are committed to resolving any concerns you may have and will respond to all enquiries promptly and in good faith.