Afiyah · Policy notice · 29 October 2026
Privacy governance and accountability.
Privacy needs ownership, evidence and review throughout the service lifecycle. This policy sets the requirements for Afiyah’s teams and processors.
Finding your country preference…
Ownership and independent challenge
Ironleaf Group FZE is responsible for the processing it controls. Privacy, security, product and clinical responsibilities must have named owners in the internal register. A combined role must not approve its own high-risk work without independent challenge. A legally required data protection officer or representative must have the required independence and contact arrangements; this notice does not invent appointments or statutory staff thresholds.
Records, lawful bases and privacy by design
Document each processing purpose, data category, lawful basis, recipient, location, retention rule and responsible owner. Minimize fields and permissions by default. Consent must be specific and withdrawable where relied upon; contract, legal duties or another permitted basis must not be disguised as optional consent. Health and other sensitive data require the additional condition and permissions applicable locally.
High-risk processing and change control
Assess privacy, clinical and security risks before a new health use, consequential AI feature, sensitive inference, partner export or material vendor change. Complete a data protection impact assessment where required, consult qualified reviewers and obtain any necessary authority approval before processing. Record the evidence, mitigations, residual risk and release decision. Review again after material changes or an incident.
Processors and transfers
Approve providers for the actual service and data involved, with due diligence and a binding agreement covering instructions, confidentiality, security, subprocessors, assistance, incident notification and deletion or return. A transfer requires its own lawful mechanism and any local health-sector permission; a supplier’s popularity or GCC storage address is insufficient. A HIPAA business associate agreement is required only where that legal role applies.
Rights, incidents and evidence
Maintain a rights-request log, consent evidence, retention and deletion records, access reviews and incident decisions without unnecessary health content. Apply the legal notification trigger and deadline for the affected jurisdiction rather than assume one global 72-hour rule. Train staff on their roles, restrict access to trained personnel and review this policy at least annually and when material law or service changes occur. Exceptions require a named owner, reason, safeguards and expiry.
Questions and complaints
Contact privacy@getafiyah.com for privacy, permissions, deletion or security concerns, and contact@getafiyah.com for service complaints. Include a brief description and a safe reference; do not attach health records, identity documents, passwords or card details to an initial email. We verify identity and authority before releasing or changing personal data. You may complain to the competent regulator or court without first giving up any statutory right.
United Arab Emirates: Personal Data Protection Law
Where applicable, Afiyah follows Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, including its rules on lawful processing, clear notices, consent, security, individual rights and international transfers. Free-zone registration alone is not an exemption; a separate free-zone data-protection regime applies only where its jurisdiction actually covers the processing. Personal health data governed by specific legislation is addressed under that sector legislation, including UAE Federal Law No. 2 of 2019 and its applicable implementing rules. Read Health information. Protected by purpose. and Your data. Practical rights..
Saudi Arabia: Personal Data Protection Law
Where applicable, Afiyah follows Saudi Arabia’s Personal Data Protection Law (PDPL), issued by Royal Decree M/19 and amended by Royal Decree M/148, its Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom, as amended. Its scope includes processing concerning individuals residing in the Kingdom by organizations outside it. We identify the purpose and legal basis before collection, distinguish required from optional information, limit collection and retention, and enable the applicable rights. Legitimate interests cannot justify processing sensitive data under the Saudi PDPL; health processing requires a separately applicable lawful basis and safeguards.
UAE and Saudi international-transfer safeguards
Each transfer is assessed against the law governing the affected person, service and data. UAE transfers within the federal PDPL scope require a mechanism permitted under Articles 22 or 23. Saudi transfers require the PDPL Article 29 conditions and the current Transfer Regulation, including an applicable adequacy basis, appropriate safeguards or a permitted exception, and a risk assessment where required. This assessment covers onward transfers and overseas support access. US website enquiries and GCC app records are separate flows requiring their own review. Selecting a country, accepting cookies or choosing a GCC server does not itself authorize a transfer. Processing must not proceed where the required mechanism or sector permission is absent.
UAE and Saudi breach notification
For Saudi processing, notify SDAIA within 72 hours of becoming aware of a breach when the trigger in Implementing Regulation Article 24 is met, and notify affected people without undue delay when the corresponding harm or rights threshold is met. Document the assessment and supplement incomplete information with reasons for any delay. UAE notification follows the applicable federal or health-sector trigger, authority and prescribed deadline; this policy does not substitute a universal 72-hour deadline for the UAE rules. Processor contracts must support timely escalation to the responsible controller.