Personal Data — any information relating to an identified individual, or to an individual who can be identified directly or indirectly, such as by name, contact details, location or an identification number.

Sensitive Personal Data — personal data that reveals, directly or indirectly, information of a more private nature, including data concerning an individual's physical or mental health, treatment and medical history.

Processing — any operation performed on personal data, whether or not by automated means, including collecting, recording, storing, using, sharing, transferring, altering, restricting, erasing and destroying.

Data Controller — the person who determines how and why personal data is processed.

Data Processor — a person who processes personal data on behalf of, and on the instructions of, a Data Controller.

We act as the Data Controller for the personal data described in this policy. This means we determine how and why your personal data is processed, we decide what is collected and for what purpose, and we remain accountable for how it is handled — including where we engage others to process it on our behalf.

We collect only the personal data reasonably necessary to provide our services, operate our business, comply with our legal obligations, and improve the experience of our clients. We do not collect information simply because it may prove useful later.

Information you provide to us. Your name, email address, mobile number, and the address at which your treatment will take place. Where you create an account, your login credentials are managed by our authentication provider; we do not have access to your password.

Booking and treatment records. The treatments you have booked, the dates and times of your appointments, the therapist who attended, your stated preferences, and notes made by your therapist that are relevant to your ongoing care.

Payment information. We do not collect or store card details. Card payments are processed by our payment provider. We receive confirmation that a payment has been made, the amount, the final four digits of the card and a transaction reference.

Information collected automatically. Limited technical information when you use our website, including IP address, browser type and pages visited, used to keep the website secure and functioning correctly.

Health information. Treated separately, and described in the following section.

Certain treatments are not suitable for everyone. Lymphatic drainage, post-surgery recovery work and pre- and post-natal treatments each carry circumstances in which they should not be performed, or should be adapted. We therefore ask about relevant medical conditions, medications, pregnancy, recent surgery and similar matters before your treatment.

We collect this information for one reason: so that your treatment can be delivered safely. We ask only for what is necessary for that purpose, and we do not use health information for marketing.

Health information is Sensitive Personal Data, and we treat it accordingly.

• We ask for it separately and explicitly, rather than including it within general terms and conditions.
• Access is limited to authorised personnel involved in arranging or delivering your treatment.
• Our therapists are subject to professional confidentiality obligations.
• Where a treatment requires clearance from your treating doctor or surgeon, we will tell you before your appointment.

You are not obliged to provide health information. If you choose not to, we may be unable to deliver a particular treatment safely, and we may decline to proceed.

We process personal data only where permitted under the Personal Data Protection Law of the United Arab Emirates. Depending on the circumstances, this may include processing necessary for the performance of our contract with you, processing required to meet a legal obligation, processing that serves our legitimate interests where the law permits it, and processing carried out with your explicit consent — which we obtain where the law requires it, including in relation to Sensitive Personal Data.

We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.

Where you have given your consent, we may contact you with newsletters, seasonal offers, information about new treatments, and invitations to retreats and events. We may do so by email, WhatsApp or SMS, according to the preferences you have given us.

Marketing is always optional. It is never a condition of booking a treatment, and declining it does not affect the service you receive.

You may withdraw your consent at any time — by using the unsubscribe link in any email, by replying to ask us to stop, or by writing to us at info@cyanuae.com. We will act on your request promptly. Withdrawing consent does not affect communications sent before the withdrawal.

We will continue to send messages necessary to the service itself, such as booking confirmations, appointment reminders and payment receipts. These are not marketing communications.

We share personal data only where necessary, and only with those who need it.

Our therapists receive the information required to attend your appointment and deliver your treatment safely, and no more.

Service providers acting on our instructions, including our payment provider, our cloud hosting and database providers, and our email and messaging providers. These parties process personal data only as necessary to provide their services to us or to comply with legal obligations, and are not permitted to use it for their own purposes.

Professional advisers, such as our legal, accounting or insurance advisers, where necessary and in confidence.

Government and regulatory authorities, where we are required to disclose personal data by applicable law, by a court, or by a competent authority, or where disclosure is necessary to protect the safety of any person.

We retain personal data only for as long as reasonably necessary for the purposes described in this policy.

In some cases we are required to retain information for longer in order to meet legal, tax, regulatory or insurance obligations, or to establish, exercise or defend legal claims. Records relating to treatments and to client health are retained for a period appropriate to the nature of the care provided.

We review our retention practices periodically. Where personal data is no longer required, it is securely deleted or anonymised.

Subject to the conditions and exceptions set out in UAE law, you have the right to:

• Access the personal data we hold about you, and to be informed how it is processed
• Receive your personal data in a structured, machine-readable format, or request its transfer to another controller
• Correct personal data that is inaccurate or incomplete
• Request erasure of your personal data, subject to records we are required to retain
• Restrict the processing of your personal data in certain circumstances
• Object to processing, including processing for marketing purposes
• Object to automated processing where it produces legal consequences or similarly significant effects for you
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise any of these rights, contact us at info@cyanuae.com. There is no charge.

To protect your privacy, we may ask you to confirm your identity before acting on a request. This ensures that personal data is not disclosed to, or altered by, anyone other than you.

We will respond as promptly as reasonably possible.

We implement reasonable administrative, organisational and technical measures designed to protect personal data against unauthorised access, disclosure, misuse, alteration and loss.

Access to client records is restricted to those who require it in order to perform their role. Card details are handled by our payment provider and do not reach our systems. Our therapists are given only the information relevant to the appointment they are attending.

No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. Where a personal data breach occurs that presents a risk to your personal data, we will notify the competent UAE authority and, where required, affected individuals, without undue delay.

Essential cookies are necessary for the website to function. They keep you signed in, remember the contents of your booking, and help keep the site secure. The website will not work properly without them.

Analytics cookies, where used, help us understand how visitors move through the site so that we can improve it. They do not identify you personally.

You can control or block cookies through your browser settings. If you block essential cookies, parts of the website may not work as intended.

Our website may contain links to websites operated by others, including social media platforms and messaging services. This Privacy Policy does not apply to those websites, and we are not responsible for their content or their privacy practices. We encourage you to read the privacy policy of any website you visit through a link from ours.

We use artificial intelligence to assist with client enquiries through our website concierge, and to support certain administrative functions.

Artificial intelligence is not used to make medical assessments, diagnoses or treatment decisions. Decisions about whether a treatment is suitable for you are made by qualified people.

We do not use artificial intelligence to make solely automated decisions that produce legal consequences or similarly significant effects for you.

Cyan Wellness offers wellness services for babies and children, and we take particular care with the personal data of younger clients.

Services for individuals under 18 are booked by a parent or legal guardian. Any health or personal information relating to a child is provided by that parent or legal guardian, and we process such information in accordance with applicable UAE law.

We do not knowingly collect personal data directly from children online without the involvement of a parent or legal guardian. If you believe a child has provided us with personal data without such involvement, please contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our services or in applicable law. The current version is always the one published on this page.

Where a change materially affects how we use personal data we have already collected, we will bring it to your attention directly.

If you have a concern about how we have handled your personal data, please contact us first at info@cyanuae.com. We would prefer the opportunity to put things right, and most matters are resolved quickly and directly.

If you remain dissatisfied, you are entitled to raise the matter with the competent data protection authority in the United Arab Emirates.

CYAN WELLNESS LIFESTYLE COACHING L.L.C
Dubai, United Arab Emirates

Email: info@cyanuae.com

For any privacy enquiries, requests to exercise privacy rights, or questions regarding this Privacy Policy, individuals may contact us using the above email address.