Your health data in the UAE: what Clare keeps, and who sees it

Health data is the most sensitive information most people will ever hand to a company. This post sets out, in plain language, what Clare collects, where it is kept, who can see it, what the UAE Personal Data Protection Law requires of us, and the rights you have over every record. If a question is not answered here, the full privacy policy is linked from every page of the site.

The law that applies

Clare operates under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the UAE PDPL, which came into force in January 2022. It treats health data as a special category that requires explicit consent, a stated purpose, and stronger safeguards than ordinary personal data. Separately, the UAE's health data law, Federal Law No. 2 of 2019 on the use of information and communication technology in health fields, restricts storing or transferring health data outside the country except in defined cases.

In practice those two laws set the rules Clare is built to: you consent to a stated purpose, the data stays in the UAE, and you keep control of it.

What we collect

• Account details: name, email, phone number, date of birth and sex, which reference ranges depend on.
• Laboratory results: the official report from the licensed laboratory that ran your panel, and the values in it.
• Records you upload: past bloodwork, prescriptions and reports from other providers.
• Wearable data: only the types you choose to share from Apple Health, Health Connect, Oura, Withings or Fitbit.
• What you ask Clare AI, so an answer can refer to the question before it.
• Booking details: an address for a home draw, and the appointment.

We do not collect location in the background, contacts, or anything from your phone beyond the health types you explicitly permit.

Where it is kept

Clare's systems run in Microsoft Azure's UAE North region, and your health data is stored there. It is encrypted in transit and at rest, and the fields that identify a person or describe their health are encrypted a second time with keys held apart from the data they protect. Backups are encrypted the same way and stay in the same region.

Who can see it

• You. Everything, always.
• The laboratory that ran your sample sees what it needs to run it and report it. It is a licensed provider with its own obligations under the Dubai Health Authority, the Department of Health Abu Dhabi or the Ministry of Health and Prevention.
• Clinicians involved in your care, when a care service is in use and you have agreed to it.
• Clare staff, only as needed to run the service, under access that is logged and reviewed. Nobody browses.

Nobody else. Your data is not sold, not shared with advertisers, not passed to insurers, and not disclosed to an employer. In a business membership the employer sees anonymised group figures above a minimum group size and never an individual.

Clare AI and your data

When you ask Clare AI a question, your relevant results are sent to a model to produce the answer. That happens under commercial terms that do not permit the provider to train on it, and it is not used to train anything of ours either. The answer is about your data and is non-diagnostic. Clare AI explains; it does not decide.

Your rights

Under the PDPL you can:

• Access everything Clare holds about you.
• Export it. The full panel, with the reference ranges used, downloads as a file you can hand to any doctor.
• Correct anything that is wrong.
• Withdraw consent for any data type, at any time, from the app.
• Delete your account and the data in it, subject to the retention the laboratory and the law require for official results.
• Complain to the UAE Data Office, the regulator under the PDPL, if you believe your rights have not been respected.

How long it is kept

Your account and the data in it are kept for as long as you are a member and for a defined period after you leave, so a returning member does not start from nothing. Official laboratory results are subject to the retention periods health regulators require of licensed providers, which are long, and that retention sits with the laboratory. Everything else is deleted on request.

If something goes wrong

The PDPL requires that a breach affecting your data is reported to the regulator and, where it puts you at risk, to you. Clare's incident process does both, and says what happened and what was done rather than the minimum the law allows.

Why this is the product

The whole argument for Clare is that health data becomes more useful the longer it is kept in one place. That argument only works if the place is trusted. So the privacy position is not a legal page at the bottom of the site. It is the reason a member can add a wearable, upload an old result, or ask a question, and be certain that the answer goes to nobody but them.