Privacy Policy

Who we are

Care Journey Consultancy LLC ("Care Journey", "we", "us" or "our") operates care-journey.com from Dubai, United Arab Emirates.

For website-related personal data, the primary point of contact is Care Journey Consultancy LLC, 9th Floor, Boulevard Plaza T1, Business Bay, Dubai, UAE. You can contact us at connect@docndoc.com.

References on this website to DOCNDOC or related group brands describe business or brand relationships. The entity responsible for a particular client engagement will be the entity identified in the applicable proposal, quotation, statement of work or contract.

Scope of this policy

This policy applies to personal data collected through this website, public enquiry forms, newsletter sign-ups, recruitment enquiries, website analytics and similar interactions that we control.

It does not replace a client contract, data-processing agreement, employee privacy notice or a healthcare provider's own privacy notice. Where a separate agreement applies, that agreement may contain additional or more specific terms.

Personal data we may collect

Depending on how you interact with us, we may collect the following categories of information:

• Identity and contact details such as your name, business email address, telephone number, company, clinic or organisation.
• Enquiry information, project context, service interests, preferred contact method and messages you choose to send.
• Commercial and client information such as quotation details, contract contacts, billing contacts and service-delivery records where you become a client.
• Recruitment information you voluntarily provide when contacting us about a role.
• Technical and usage information such as IP address, browser/device information, referral data, page activity, security logs and analytics identifiers.
• Marketing preferences, newsletter subscription status and unsubscribe or suppression records.
• Files, screenshots or other materials you voluntarily provide for an audit, consultation or contracted service.

Please do not send patient health data through public forms

Care Journey is a healthcare marketing and consultancy business; it is not a healthcare provider and our public website forms are not intended for patient records, medical histories, diagnostic information or other sensitive health data.

Do not submit identifiable patient data, medical records, test results, images containing patient identifiers, or other confidential clinical information through public website forms, newsletter forms or general WhatsApp contact links.

If a contracted project genuinely requires access to sensitive or regulated data, the scope, lawful basis, security controls, permitted recipients and transfer arrangements should be agreed separately before any such data is shared.

How we use personal data

We may process personal data for purposes that include:

• Responding to enquiries, arranging consultations and preparing quotations or proposals.
• Taking steps requested by you before entering into a contract and delivering contracted services.
• Operating the website, maintaining security, preventing misuse and diagnosing technical issues.
• Measuring website performance and understanding which content or services are useful.
• Managing newsletters or other communications where you have requested them or where they are otherwise permitted by applicable law.
• Recruitment and talent enquiries.
• Maintaining business, legal, accounting, audit and compliance records.
• Establishing, exercising or defending legal claims and complying with lawful requests from competent authorities.

Lawful basis and consent

Where the UAE Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data applies, personal data must be processed in accordance with the law's requirements, including consent where required and the statutory circumstances in which processing may be permitted without consent.

Depending on the context, our processing may be necessary to respond to your request, take steps toward or perform a contract, comply with legal obligations, protect systems and business operations, or rely on another lawful ground or statutory exception available under applicable law.

Where we rely on consent, you may withdraw that consent for future processing, subject to legal or contractual limits and without affecting processing that was lawful before withdrawal.

Marketing communications

We do not sell personal data to advertisers.

We use contact details for promotional communications only where permitted by applicable law and our relationship with you. Newsletter and similar marketing messages should provide a practical way to unsubscribe. We may retain a minimal suppression record so that an opt-out is respected.

Cookies, analytics and similar technologies

The website may use cookies, pixels, local storage or similar technologies for essential functionality, security, preferences and analytics. Our Cookie Policy explains these categories in more detail.

Analytics technologies may include WordPress or Jetpack site statistics or another measurement service that we deliberately enable. Providers and configurations can change over time; where a material change affects this policy, we will update the policy accordingly.

Who may receive personal data

We may share personal data only where reasonably necessary with categories of recipients such as:

• Website hosting, security, analytics, email, CRM, cloud-storage and communications providers acting on our instructions or under their own applicable obligations.
• Professional advisers, auditors, insurers, accountants and legal advisers.
• Group or affiliated operations that support service delivery, administration or technology, subject to appropriate access controls.
• Government, regulatory, judicial or law-enforcement authorities where disclosure is required or lawfully requested.
• A buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and legal safeguards.

International and cross-border transfers

Some service providers or group operations may process data outside the UAE. Where cross-border transfer rules apply, we will use the transfer mechanism, contractual protection or other safeguard required by applicable law and will limit transfers to what is reasonably necessary for the relevant purpose.

Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to manage the relationship with you, to maintain required business and accounting records, to resolve disputes, to enforce agreements and to meet legal or regulatory requirements.

Retention periods therefore vary by record type. When information is no longer required, we aim to delete, anonymise or securely isolate it, subject to backup cycles and legal preservation requirements.

Your privacy rights

Subject to the law that applies to your data and any lawful exceptions, you may have rights to obtain information about processing, request access, correct inaccurate or outdated data, request deletion, restrict or stop certain processing, withdraw consent, object to certain processing, and receive or transfer data in a structured form where portability applies.

You may also have the right to complain to the competent data-protection authority. We may need to verify your identity before acting on a rights request and may ask for information necessary to locate the relevant records.

To make a privacy request, email connect@docndoc.com and state that your request relates to privacy or personal data.

Security and personal-data incidents

We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the information and the systems involved. No internet transmission or storage system can be guaranteed to be completely secure.

If a personal-data incident occurs, we will assess it and take the notification and remediation steps required by applicable law.

Children

This website is intended for businesses, healthcare organisations, professionals and other adult users. It is not directed to children, and we do not knowingly seek personal data from children through public website forms.

External websites

This website links to third-party websites, platforms and official sources. Their privacy practices are controlled by those third parties. Review the relevant privacy notice before submitting personal data to an external service.

Changes to this policy

We may update this Privacy Policy when our services, technology, suppliers or legal requirements change. The date shown on this page indicates the latest published version.

UAE legal references

This policy is designed to support transparent website practices in the UAE. The following official resources provide useful background on the legal framework: