1. Who we are
Aesthetica ("Aesthetica", "we", "us", "our") is an online platform at aesthetica.ae that helps people in the United Arab Emirates find and compare aesthetic and dental clinics. Aesthetica is owned and operated by Ibzora Enterprises FZC, a company registered in the Sharjah Research, Technology and Innovation Park (SRTIP) Free Zone, Sharjah, UAE.
We are the controller of the personal data described in this Policy. This Policy explains what personal data we collect, why we collect it, how we protect it and the rights you have. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and other applicable UAE laws.
If you have a question about this Policy or your data, contact us at support@aesthetica.ae.
2. Who this Policy applies to
This Policy applies to:
- Visitors who browse aesthetica.ae without an account
- Patients and users ("Clients") who create an account, save clinics or contact clinics through the Platform
- Clinics and their staff who register, manage a listing or use clinic tools
- Anyone who contacts us or joins a waiting list
It does not cover websites, apps or services run by others, including clinics' own websites, WhatsApp, Instagram or Google. When you contact a clinic, the clinic handles your information under its own privacy practices.
3. Information we collect
We only collect what we need to run the Platform.
3.1 Information you give us
Clients:
- Name, email address and phone number
- Date of birth (to confirm you are 18 or over)
- Gender (optional)
- Your password (stored only in hashed form)
- Clinics you save and preferences you choose, such as treatment, area or budget filters
- Messages you send us
Clinics:
- Clinic name, contact person, email, phone and WhatsApp number
- Licence details and supporting documents we request
- Team members' names, titles, qualifications and photos
- Treatments, prices, offers, opening hours, location, photos and videos
- Billing details for paid services (card details are handled by Stripe, not stored by us)
Waiting list sign-ups: name, email, phone and clinic name where relevant.
3.2 Information collected when you use the Platform
- Account activity: when you are logged in, we record actions such as clinics you view, save or contact (for example, tapping a clinic's WhatsApp or call button) and treatments you view. We use this to show you your own history, for example "last clinic contacted", and to keep your account secure.
- Usage statistics (pseudonymised): to count visits and clicks, for example views of a clinic's profile or taps on its WhatsApp button, and to prevent fraud, we store a scrambled (hashed) version of your IP address, your browser type and a session ID, but not your name or email address. Clinics only see totals. Our website analytics also record pages visited, referring pages, device type and approximate country or city, without cookies.
- Waiting list: when you join a waiting list, we record a hashed version of your IP address to prevent spam sign-ups.
- Security information: IP address, login attempts, verification codes and security events, used to prevent fraud, abuse and unauthorised access.
3.3 Information from third parties
- Sign in with Google: if you choose this, Google shares your name, email address and profile picture with us.
- Google Places: public information about clinics, such as ratings, reviews and opening hours.
3.4 Health-related information
Aesthetica is not a healthcare provider and does not need your medical history. Please do not send us medical details, such as diagnoses, medications or medical history, through our forms, AI features or messages.
Your interest in a treatment, for example the treatments you view or save, could indicate something about your health or appearance. We treat this information as sensitive. We only use it to provide the features you ask for, we never share it with clinics in identifiable form, and we never sell it.
4. How we use your information
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and manage your account | Account details | Your consent and performing our agreement with you |
| Show clinics, treatments, prices and search results | Preferences, filters, usage data | Performing our agreement with you |
| Show you your saved clinics and history | Account activity | Your consent |
| Verify and publish clinic listings | Clinic and licence details | Performing our agreement with the clinic and our legal obligations |
| Send account emails (verification codes, password resets, important notices) | Email address | Performing our agreement with you |
| Send clinics performance summaries | Clinic contact details, aggregated statistics | Performing our agreement with the clinic (clinics can unsubscribe) |
| Process payments for paid clinic services | Billing details (via Stripe) | Performing our agreement with the clinic |
| Keep the Platform secure and prevent fraud and abuse | Security information | Our legal obligations and protecting users |
| Improve the Platform | Pseudonymised usage statistics | Your consent, where required |
| Comply with the law and respond to lawful requests | As required | Our legal obligations |
Where we rely on your consent, you can withdraw it at any time (see section 11). Withdrawing consent does not affect processing that already took place.
We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
5. AI features
Some features use artificial intelligence, for example an AI assistant that helps you explore treatment options. When available:
- What you type is sent to our AI provider (OpenAI) to generate a reply.
- Responses are general information only and are not medical advice.
- Please do not enter medical details or other sensitive personal information.
- We do not use your messages to identify you, and we do not allow our AI provider to use them to train its models where this option is available to us.
6. Who we share information with
We do not sell or rent your personal data.
Clinics: we do not share your identity with clinics. Clinics see only totals, such as the number of profile views or WhatsApp button taps. When you choose to contact a clinic, for example by WhatsApp or phone, you share your details with that clinic directly.
Service providers: we use trusted providers who process data on our behalf, under contracts that require them to protect it and use it only for our instructions:
| Provider | Purpose | Location of processing |
|---|---|---|
| Supabase | Database, user accounts, file storage | Germany (EU) |
| Vercel | Website hosting and cookie-free analytics | Global network, including the United States |
| Resend | Sending account and service emails | Japan |
| Sign in with Google, Google Places, and Google Maps when you choose to view a map | Global | |
| Mapbox | Interactive clinic map, loaded only when you open the map view. Mapbox records that the map was loaded, using an anonymous ID stored in your browser | Global, including the United States |
| Stripe | Payments for paid clinic services | Global |
| OpenAI | AI features, when available | United States |
| Meta (WhatsApp) | WhatsApp messaging with our support team | Global |
Legal reasons: we may disclose information if required by UAE law, a court order or a competent authority, or to protect the rights, safety or property of our users, clinics or Aesthetica.
Business changes: if Aesthetica is sold, merged or restructured, personal data may be transferred to the new owner, who will be bound by this Policy.
Contacting us on WhatsApp
If you message Aesthetica on WhatsApp, a member of our team replies to you directly. Your messages are handled by WhatsApp (Meta) under its own privacy policy. We do not copy your WhatsApp conversations into our systems.
7. Where your data is stored
Our main database is hosted in Frankfurt, Germany, and some of our providers process data in other countries, including the United States. These countries may have different data protection laws from the UAE.
We only transfer personal data outside the UAE where permitted by the PDPL, including where you have given your consent or where the provider gives adequate protection under contract. We ask for your consent to these transfers when you create an account.
We are reviewing our hosting arrangements to reduce transfers of sensitive information outside the UAE and will update this Policy if they change.
8. Cookies and similar technologies
We use only what we need to run the Platform:
- Essential: keep you logged in, keep your session secure and remember your choices on a page. These are needed for the Platform to work.
- Preferences: remember settings such as filters or a closed banner, stored in your browser.
- Analytics: our analytics are privacy-friendly. They do not use advertising cookies and do not track you across other websites.
- Maps: maps from Google (on clinic pages) and Mapbox (in the clinic map view) load only when you choose to view them. Once loaded, they may set their own cookies or identifiers under their own privacy policies.
We do not use advertising or cross-site tracking cookies. You can clear or block cookies and browser storage in your browser settings, but parts of the Platform, such as staying logged in, may stop working.
If we add other cookies in the future, we will update this section and ask for your consent where required.
9. How long we keep information
- Account information: for as long as your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep it longer.
- Billing and transaction records: for as long as required by UAE commercial and tax laws, generally five years.
- Security logs: for up to 12 months, unless needed longer to investigate a security incident or misuse.
- Verification codes and password reset links: they expire shortly after they are issued and are then deleted.
- Waiting list details: until the service launches for you or you ask us to remove them.
- Usage statistics: pseudonymised records (hashed IP address, browser type and session ID) are kept for up to 24 months and then deleted. Monthly totals that do not identify anyone may be kept for longer.
10. How we protect your information
We use technical and organisational measures to protect personal data, including:
- Encrypted connections (HTTPS)
- Hashed passwords and one-time verification codes
- Access controls so that only authorised people can access data
- Rate limiting and monitoring to detect abuse and unauthorised access
No online service can be completely secure. If a data breach affects your personal data and is likely to put your rights at risk, we will notify you and the relevant UAE authorities as required by law.
Please use a strong, unique password and tell us straight away at support@aesthetica.ae if you think your account has been accessed without permission.
11. Your rights
Under the PDPL, you have the right to:
- Access the personal data we hold about you and receive a copy
- Correct inaccurate or incomplete data
- Delete your data, subject to legal exceptions
- Restrict our processing of your data in certain cases
- Object to processing, including for marketing, and to decisions based solely on automated processing
- Withdraw your consent at any time
- Receive your data in a commonly used format, where applicable
To use any of these rights, email support@aesthetica.ae from the email address linked to your account. We may need to confirm your identity. We will respond within 30 days.
You can delete your account at any time by contacting us. If you are not satisfied with our response, you can file a complaint with the UAE Data Office.
12. Marketing
We do not currently send marketing newsletters. If we do in the future, we will only send them with your consent, and every message will include an easy way to unsubscribe.
We send service messages, such as verification codes, password resets and important changes to our Terms or this Policy, because they are needed to run your account.
13. Children
Aesthetica is for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.
14. Changes to this Policy
We may update this Policy to reflect changes to the Platform or the law. If we make material changes, we will notify you by email or a notice on the Platform at least 30 days before the changes take effect, unless a change is required sooner by law. The "Last updated" date at the top shows when this Policy was last changed.
15. Language
An Arabic version is available on request from support@aesthetica.ae. If there is any conflict between the English and Arabic versions, the Arabic version prevails to the extent required by UAE law.
16. Contact us
Ibzora Enterprises FZC
Sharjah Research, Technology and Innovation Park (SRTIP) Free Zone
Sharjah, United Arab Emirates
Email: support@aesthetica.ae