Privacy policy (draft)

1. Who we are and what this policy covers

Zahwa is a digital platform for booking salon and clinic appointments (aesthetics, dermatology and dentistry) in Kuwait, the GCC countries and Egypt, through the customer app, the partner app, the dashboards and this website.

This policy explains how we collect, use, protect and share your personal data, and your rights over it. The final text names the entity responsible for your data in each country, its address and how to contact its data protection officer.

We follow the data protection laws of every country we operate in, including Kuwait's Data Privacy Protection Regulation, Saudi Arabia's Personal Data Protection Law and the personal data protection laws of the UAE, Bahrain, Qatar, Oman and Egypt; the final text sets out which applies in each country.

2. The data we collect

Account data: your phone number (used to sign in with a code we send), name, email if you add one, a linked Google or Apple account if you link one, and the language and country you choose.

Family profiles: if you add family members to book for them, we keep what you enter about them (name, relationship and what the booking needs). You are responsible for having the right to add them.

Bookings: the place, services, time and practitioner, the booking status, notes you write, and reviews you publish after a completed visit.

Payments: the amount, method, status and the payment gateway's reference. We never store your full card number or security code; the licensed payment gateway keeps them, and we keep only a substitute token and the last four digits if you choose to save a card.

Location: only when you tap “Near me” and allow it; we do not track your location in the background. You can always pick your area instead.

Technical data: device type and system, network address, and security logs (such as sign-in attempts) to protect accounts and prevent abuse.

3. Health data in clinic bookings

When you book at a clinic you may be asked for pre-visit forms (such as medical history, allergies and consents), and the clinic may write treatment notes or take clinical photos with your consent.

This is sensitive data: it is encrypted when stored with separate keys, only the authorised practitioners of the clinic treating you can see it, and every access is logged. Emergency access outside normal permissions needs a written reason and is reviewed.

The Zahwa team does not see the content of your medical record in normal work, health data is never used for marketing or advertising, and it is never shared with another place without your consent.

The clinic keeps the medical record for as long as the health licensing rules of its country require, and is responsible for it as your care provider.

4. Why we use your data (and the legal basis)

To provide the service you asked for (performing the contract): creating your account and signing you in, completing bookings with the place, sending confirmations and reminders, and processing payments, fees and refunds.

For our legal obligations: keeping financial and tax records, and answering the competent authorities as the law requires.

For our legitimate interest in protecting the platform: preventing fraud and abuse, attempt limits, securing accounts, and improving the service with aggregated data that does not identify you.

With your consent: marketing messages and offers, location, health data and clinical photos. You can withdraw consent at any time; this does not affect what happened before.

5. Messages and notifications

We send service messages (sign-in codes, booking confirmations, reminders, changes and cancellations, payment receipts) by SMS, WhatsApp, app notifications or email. These messages are part of the service.

We do not send non-urgent messages during night-time quiet hours; they wait until the morning in your country's time.

Marketing messages reach you only with your consent, and you can turn them off in the settings at any time.

6. Who we share your data with

The place you book with: what it needs to serve you (name, booking, services, notes, and your phone number only for the staff who need it). A practitioner sees their bookings without your phone number unless their role requires it.

Service providers working for us and only on our instructions: licensed payment gateways (such as Tap and MyFatoorah), SMS, WhatsApp, email and notification providers, and hosting. They are contractually bound to protect the data and not use it for their own purposes.

Competent authorities: when there is a legal obligation or an order from a competent authority.

We do not sell your personal data to anyone, and we do not share it for advertising.

7. Where your data is kept and transfers abroad

Data is kept on secured servers. If providing the service requires moving data outside your country (for example to a messaging provider or a payment gateway), this happens only under the conditions your country's law sets and with suitable safeguards. The final text names the storage locations for each country.

8. How we protect your data

Connections are encrypted, health data and provider keys are encrypted when stored, permissions inside each place and in the Zahwa team are limited by role and branch, and sensitive actions are written to an audit log that cannot be edited.

No money moves automatically (refund or payout); every exceptional money movement is a recorded human decision.

If a security incident affects your data, we tell you and the competent authority within the time the law requires.

9. How long we keep data, and deleting your account

We keep your data while your account exists and as far as the service needs it.

You can delete your account in the app. Your upcoming bookings are cancelled with no fee, your sessions are closed, and you have 14 days to change your mind by signing in again. After that, your personal data is removed from the account for good.

Booking, payment and invoice records stay, without anything that identifies you, for as long as accounting and tax laws require. The medical record stays with the clinic under health licensing rules (see section 3).

10. Your rights

Under your country's law you may: see your data and get a copy, correct it, delete it, restrict or object to its use, move it, and withdraw consent at any time.

You will find most of this in the app (profile, settings, account deletion). For the rest, contact us through the “Contact” page; we answer within the time the law sets and may first ask you to confirm your identity.

If you are not satisfied with our answer, you may complain to the data protection authority in your country.

11. Minors

Accounts are for people of legal age in their country. A parent or guardian books for their children through family profiles in their own account, and is responsible for their data and consents, including clinic consents.

12. Join requests from this website

When you send a request to join, we keep what you wrote and the network address to prevent abuse, use it only to contact you about joining, and delete it if you do not join within a period the final text sets.

13. Changes to this policy

We may update this policy. We tell you in the app about any material change before it takes effect, and the date of the last update appears at the bottom of this page.