1. INTRODUCTION
1.1 Smart Salem Medical Center 3 FZ LLC, a company registered under the laws of the United Arab Emirates, with registered office at GO9A, Block No. 12, Dubai Knowledge Park, Dubai, UAE, PO Box 25031, license number 101110 (“Smart Salem”), makes available the Smart Salem DNA white-labelled digital platform, DNA collection experience, genetic wellness reporting experience, and related customer-facing services.
1.2 The Smart Salem DNA platform, digital reporting interface, DNA kit fulfilment, laboratory coordination, genetic analysis workflow, customer support workflow, technical infrastructure, and related digital services are powered, supported, processed, and/or fulfilled by BioCertica Inc., a company incorporated under the laws of Delaware, United States of America, file number 3454858, with business address at 1013 Centre Road, Suite 403-A, Wilmington, DE 19805, USA (“BioCertica”).
1.3 This Privacy Policy (“Policy”) explains how Smart Salem, BioCertica, and their authorised service providers collect, use, process, store, transfer, disclose, retain, secure, and otherwise handle your personal data, health data, genetic data, biological sample information, digital account information, consent records, support communications, and related information when you access or use the Smart Salem DNA products and services.
1.4 This Policy must be read together with the Smart Salem DNA Terms of Service, any informed consent documentation, any patient-facing consent form, any product-specific consent prompt, and any other notice or policy made available to you before or during your use of the Smart Salem DNA products and services.
1.5 For purposes of this Policy, references to “we”, “us”, and “our” may refer to Smart Salem, BioCertica, and/or their authorised service providers, depending on the relevant processing activity. References to “you” or “your” refer to the user, patient, customer, parent, legal guardian, lawful representative, or other person using or consenting to the Smart Salem DNA products and services.
1.6 This Policy does not apply to third-party websites, platforms, applications, products, services, payment providers, laboratories, couriers, healthcare professionals, wellness merchants, or other third parties that we do not own or control, except where such third parties process your information on our behalf or under our instructions. Third parties may have their own privacy notices and terms, and you should review them before using those services.
1.7 THIS POLICY CONTAINS IMPORTANT INFORMATION ABOUT THE PROCESSING OF SENSITIVE PERSONAL DATA, INCLUDING HEALTH DATA, GENETIC DATA, AND BIOLOGICAL SAMPLE INFORMATION. IT ALSO EXPLAINS THAT YOUR DNA SAMPLE AND RELATED DATA MAY BE EXPORTED, TRANSFERRED, PROCESSED, ANALYSED, HOSTED, STORED, OR OTHERWISE MADE AVAILABLE OUTSIDE THE UNITED ARAB EMIRATES, INCLUDING IN THE UNITED STATES OF AMERICA, SOUTH AFRICA, THE EUROPEAN UNION, AND/OR ANY OTHER JURISDICTION WHERE AN APPROVED LABORATORY, TECHNOLOGY PROVIDER, CLOUD PROVIDER, LOGISTICS PROVIDER, CUSTOMER SUPPORT PROVIDER, OR OTHER AUTHORISED SERVICE PROVIDER IS LOCATED.
1.8 If you do not agree to this Policy, the Terms of Service, or the applicable informed consent documentation, you must not use the Smart Salem DNA products and services.
2. IMPORTANT NON-DIAGNOSTIC WELLNESS PRIVACY NOTICE
2.1 The Smart Salem DNA products and services are intended to provide non-diagnostic lifestyle, wellness, trait, ancestry, nutrition, fitness, weight management, metabolic, pharmacogenomic, skincare, mindfulness, and other genetic wellness insights, depending on the product or report package selected by you or made available to you.
2.2 The processing of your data is intended to support the provision of non-diagnostic wellness information and related services. The products and services are not intended to diagnose, treat, cure, prevent, monitor, or manage any disease, disorder, medical condition, emergency medical condition, or clinical condition.
2.3 BioCertica does not provide medical diagnosis, medical treatment, clinical care, emergency care, or licensed medical services to you. Any medical consultation, medical interpretation, diagnosis, treatment decision, prescription decision, clinical advice, or healthcare service must be provided separately by Smart Salem or another appropriately licensed healthcare professional or healthcare facility.
2.4 This Policy does not replace any separate privacy notice, consent form, patient notice, medical record notice, or regulatory notice that Smart Salem or any healthcare professional may be required to provide in connection with a separate licensed healthcare service.
3. DEFINITIONS
3.1 In this Policy, unless the context indicates otherwise:
3.1.1 “Applicable Data Protection Laws” means all data protection, privacy, cybersecurity, health data, medical confidentiality, consumer protection, electronic transactions, and related laws applicable to the processing activity, including where applicable the laws of the Emirate of Dubai, the applicable federal laws of the United Arab Emirates, Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data, and any other law or regulation applicable to Smart Salem, BioCertica, or an authorised service provider.
3.1.2 “Authorised Service Provider” means any laboratory, logistics provider, courier, cloud service provider, technology provider, customer support provider, data hosting provider, analytics provider, AI-enabled tool provider, professional adviser, subcontractor, affiliate, or other third party used by Smart Salem or BioCertica to provide, support, analyse, process, fulfil, secure, maintain, improve, or administer the products and services.
3.1.3 “BioCertica” means BioCertica Inc., a Delaware corporation, and where applicable its affiliates, subsidiaries, contractors, processors, laboratories, technology providers, and authorised service providers.
3.1.4 “Biological Sample” or “DNA Sample” means the biological sample, saliva sample, cheek swab, buccal swab, or other sample provided by you or collected from you for the purpose of performing the selected test or generating the selected report.
3.1.5 “Controller” means the person or entity that determines the purposes and means of processing personal data, where applicable under relevant data protection law.
3.1.6 “Genetic Data” means personal data relating to inherited or acquired genetic characteristics, genetic markers, genetic variants, genotype information, raw genetic data, interpreted genetic data, inferred genetic data, report data, laboratory output, or any other information derived from the analysis or processing of your DNA Sample.
3.1.7 “Health Data” means information relating to your physical health, mental health, medical history, lifestyle information, questionnaire responses, biometric information, wellness information, medication-related information, supplement-related information, and any other health-related information provided by you or generated in connection with the products and services.
3.1.8 “Informed Consent” means the consent, authorisation, permission, and acknowledgement provided by you or your lawful representative in relation to the collection, processing, transfer, export, analysis, storage, reporting, disclosure, and use of your DNA Sample, Personal Data, Health Data, Genetic Data, and related information.
3.1.9 “Partner Wellness Merchant” means any approved wellness, lifestyle, supplement, nutrition, fitness, pharmacy, health product, or related provider with which Smart Salem or BioCertica may contract to provide optional value-added services, subject to your consent and Applicable Data Protection Laws.
3.1.10 “Personal Data” means any information relating to an identified or identifiable natural person, including name, surname, contact details, date of birth, gender, nationality, account details, questionnaire data, Health Data, Genetic Data, sample identifiers, barcodes, consent records, payment records, support communications, device data, usage data, and service information.
3.1.11 “Platform” means the Smart Salem DNA white-labelled digital platform, mobile application, website, portal, reporting interface, account interface, support interface, and related digital infrastructure powered, supplied, hosted, supported, or fulfilled by BioCertica.
3.1.12 “Processor” means the person or entity that processes Personal Data on behalf of a Controller, where applicable under relevant data protection law.
3.1.13 “Report” or “Test Result” means the digital report generated from the analysis, interpretation, processing, or reporting of your DNA Sample in accordance with the selected product or report package.
3.1.14 “Smart Salem” means Smart Salem Medical Center 3 FZ LLC.
3.1.15 “Special Category Data” means sensitive data, special personal data, Health Data, Genetic Data, biometric information, medical information, or other information requiring additional protection under Applicable Data Protection Laws.
3.1.16 “Test Kit” means the DNA collection kit supplied or made available to you for the purpose of collecting a DNA Sample.
3.1.17 “Value-Added Services” means optional additional services, offerings, recommendations, consultations, product recommendations, supplement recommendations, wellness insights, partner services, or related services made available to you through Smart Salem, BioCertica, or a Partner Wellness Merchant.
4. WHO IS RESPONSIBLE FOR YOUR DATA
4.1 Smart Salem is the customer-facing provider in the United Arab Emirates and may act as Controller in relation to patient onboarding, customer relationship management, local service delivery, facility-based sample collection, payment handling where applicable, patient communications, local regulatory obligations, and any separate healthcare or clinical service provided by Smart Salem or its licensed professionals.
4.2 BioCertica acts as Smart Salem’s technical platform provider, laboratory coordination partner, fulfilment partner, genetic reporting provider, and data processor in relation to the products and services that BioCertica provides to Smart Salem. BioCertica may also act as an independent Controller for limited purposes where it is required to comply with its own legal, regulatory, security, laboratory, audit, intellectual property, platform integrity, dispute, or compliance obligations.
4.3 Where Smart Salem is the Controller and BioCertica processes Personal Data on Smart Salem’s behalf, BioCertica will process such Personal Data in accordance with Smart Salem’s documented instructions, the applicable agreement between Smart Salem and BioCertica, this Policy, the Terms of Service, the Informed Consent, and Applicable Data Protection Laws.
4.4 Where an Authorised Service Provider processes Personal Data on behalf of Smart Salem or BioCertica, we will take reasonable steps to ensure that the service provider is subject to appropriate confidentiality, security, data protection, and use-restriction obligations, taking into account the nature of the services provided.
4.5 Where you interact directly with a healthcare professional, Partner Wellness Merchant, payment provider, courier, third-party platform, or other third party, that third party may act as an independent Controller for the information you provide directly to them. Their own privacy notice may apply.
5. INFORMATION WE MAY COLLECT ABOUT YOU
5.1 When you access or use the Platform, Test Kit, Report, support services, or other products and services, we may collect and process Personal Data and Special Category Data about you.
5.2 The categories of information we may collect include:
5.2.1 identity information, including name, surname, date of birth, age, gender, nationality, identity verification information, parent or guardian details, and lawful representative details;
5.2.2 contact information, including email address, mobile number, telephone number, physical address, delivery address, billing address, and preferred communication details;
5.2.3 account information, including username, login details, authentication details, account status, profile details, consent history, preferences, and service selections;
5.2.4 DNA Sample and Test Kit information, including sample ID, barcode, kit number, swab details, collection date, collection location, courier information, shipping status, laboratory intake status, sample quality information, and processing status;
5.2.5 Genetic Data, including raw genetic data, genotype information, genetic markers, interpreted genetic data, inferred genetic data, pharmacogenomic information, trait information, ancestry information, report outputs, and related scientific or technical data;
5.2.6 Health Data and wellness information, including medical history, lifestyle questionnaire responses, physical health information, mental health information, nutrition information, fitness information, medication-related information, supplement-related information, allergies, family history where provided, and other information you choose to provide;
5.2.7 payment and transaction information, including purchase details, payment status, refund information, invoice information, transaction references, payment method type, and related information processed through payment providers;
5.2.8 logistics and courier information, including shipment documents, waybill information, customs documentation, import/export information, delivery status, return status, and sample transport records;
5.2.9 technical and device information, including device type, device identifier, operating system, browser type, IP address, mobile network details, country, approximate location, session data, cookies, analytics identifiers, usage logs, crash logs, and diagnostic information;
5.2.10 support and communication information, including emails, call notes, chat messages, Zendesk tickets, support requests, complaints, feedback, technical queries, service notes, attachments, and correspondence;
5.2.11 professional or partner information, where applicable, including professional registration information, qualification information, clinic or partner affiliation, and access permissions;
5.2.12 marketing and preference information, including communication preferences, opt-in and opt-out records, consent to marketing, survey responses, feedback forms, campaign interactions, and product interest information; and
5.2.13 legal and compliance information, including consent records, audit logs, regulatory records, dispute information, complaint records, security logs, fraud prevention records, and records required to comply with Applicable Data Protection Laws or other legal obligations.
5.3 The supply of Personal Data and Special Category Data is generally voluntary, but certain information is necessary to provide the products and services. If you do not provide required information or consent, we may not be able to register you, collect your DNA Sample, export your DNA Sample, process your DNA Sample, generate your Report, provide support, or make the products and services available to you.
5.4 The decision to provide Special Category Data, including Health Data and Genetic Data, is voluntary. However, because the products and services depend on the processing of your DNA Sample, Genetic Data, Health Data, questionnaire information, and consent records, we cannot provide the products and services if you do not agree to the required processing.
6. HOW WE COLLECT YOUR INFORMATION
6.1 We may collect information directly from you when you register, use the Platform, provide a DNA Sample, complete a questionnaire, complete consent forms, purchase a product or service, request support, contact us, provide feedback, or otherwise interact with Smart Salem, BioCertica, or the Platform.
6.2 We may collect information from Smart Salem when Smart Salem collects your information in connection with the Smart Salem DNA products and services, local facility services, sample collection, patient onboarding, payments, or customer-facing support.
6.3 We may collect information from laboratories, couriers, logistics providers, customs agents, technology providers, cloud providers, payment processors, Zendesk or other support platforms, AI-enabled tools, analytics providers, Partner Wellness Merchants, healthcare professionals, and other Authorised Service Providers involved in the products and services.
6.4 We may automatically collect technical information when you access the Platform, including device information, logs, usage patterns, session information, cookies, and analytics information.
6.5 In limited circumstances, we may collect information from public sources, regulatory sources, affiliates, service providers, or other third parties where necessary for verification, legal compliance, fraud prevention, security, service delivery, or dispute resolution.
7. PURPOSES FOR WHICH WE PROCESS YOUR INFORMATION
7.1 We process your information for the purposes set out in this Policy, the Terms of Service, the Informed Consent, and any product-specific consent prompts.
7.2 We may process your information to:
7.2.1 register your account and verify your identity, contact details, and eligibility;
7.2.2 obtain, record, verify, and manage your consent;
7.2.3 link your DNA Sample, barcode, Test Kit, questionnaire data, and account;
7.2.4 arrange sample collection, courier logistics, export, import, customs processing, laboratory intake, laboratory analysis, and sample tracking;
7.2.5 perform or coordinate genetic analysis, quality control, data processing, imputation, interpretation, report generation, and report delivery;
7.2.6 provide access to your Report through the Platform or another approved reporting channel;
7.2.7 provide customer support, technical support, ticketing, operational support, and complaint management;
7.2.8 manage payments, refunds, invoices, reconciliation, transaction disputes, fraud prevention, and accounting records;
7.2.9 administer the Platform, maintain service availability, perform updates, improve user experience, and resolve technical issues;
7.2.10 ensure security, access control, audit logging, fraud prevention, platform integrity, and misuse prevention;
7.2.11 communicate with you about your account, Test Kit, DNA Sample, Report, support request, service changes, legal notices, security notices, and operational updates;
7.2.12 provide optional Value-Added Services where you have consented to such services;
7.2.13 provide or facilitate marketing communications where permitted by Applicable Data Protection Laws and your preferences;
7.2.14 conduct aggregated, anonymised, de-identified, statistical, scientific, operational, product development, quality assurance, research, and analytics activities where permitted by Applicable Data Protection Laws and your consent;
7.2.15 train, test, maintain, audit, improve, and secure internal systems, provided that appropriate privacy and security controls are applied;
7.2.16 comply with legal, regulatory, healthcare, data protection, laboratory, customs, tax, accounting, audit, dispute, insurance, professional, clinical governance, or recordkeeping obligations; and
7.2.17 protect the rights, property, safety, security, and interests of you, Smart Salem, BioCertica, other users, service providers, regulators, or the public.
8. LAWFUL GROUNDS FOR PROCESSING
8.1 We process Personal Data and Special Category Data only where we have a lawful basis or valid permission to do so under Applicable Data Protection Laws.
8.2 The lawful grounds or permissions we may rely on include:
8.2.1 your explicit consent, including your Informed Consent for the collection, processing, export, transfer, analysis, storage, reporting, and use of your DNA Sample, Personal Data, Health Data, Genetic Data, and related information;
8.2.2 performance of a contract with you, including the Terms of Service and the provision of the products and services;
8.2.3 steps taken at your request before entering into a contract;
8.2.4 compliance with legal, regulatory, healthcare, laboratory, tax, accounting, customs, data protection, or other obligations;
8.2.5 legitimate interests pursued by Smart Salem, BioCertica, or authorised third parties, provided such interests are not overridden by your rights where applicable;
8.2.6 protection of vital interests, safety, security, or public interest where applicable;
8.2.7 establishment, exercise, or defence of legal claims; and
8.2.8 any other lawful basis or permission recognised under Applicable Data Protection Laws.
8.3 Where we rely on consent, you may withdraw consent where permitted by Applicable Data Protection Laws. Withdrawal of consent may affect our ability to provide or complete the products and services and will not affect processing already lawfully carried out before withdrawal.
8.4 We may process your information without additional notice or consent where required or permitted by Applicable Data Protection Laws, including where necessary for legal compliance, dispute resolution, security, fraud prevention, or protection of rights.
9. EXPLICIT CONSENT FOR CROSS-BORDER SAMPLE AND DATA TRANSFERS
9.1 By using the products and services and providing Informed Consent, you expressly request, authorise, and consent to the collection, processing, packaging, storage, export, import, transport, transfer, analysis, reporting, and use of your DNA Sample, Personal Data, Health Data, Genetic Data, questionnaire responses, account data, contact information, consent records, and related information as necessary to provide the products and services.
9.2 You expressly request and consent to Smart Salem, through BioCertica and its Authorised Service Providers, exporting, transferring, processing, analysing, hosting, storing, or otherwise making available your DNA Sample, Personal Data, Health Data, Genetic Data, and related information outside the United Arab Emirates.
9.3 The jurisdictions to which your DNA Sample, Personal Data, Health Data, Genetic Data, and related information may be exported, transferred, processed, analysed, hosted, or stored include the United States of America, South Africa, the European Union, the United Arab Emirates, and any other jurisdiction where BioCertica, Smart Salem, an approved laboratory, courier, cloud provider, technology provider, logistics provider, customer support provider, AI-enabled tool provider, or other Authorised Service Provider is located.
9.4 You acknowledge that cross-border export and transfer may be necessary because the laboratory, technical platform, specialist analysis provider, cloud provider, reporting provider, support provider, or other service provider may be located outside the United Arab Emirates.
9.5 You understand and agree that your DNA Sample may be sent to a laboratory selected by BioCertica or Smart Salem, which may be located in the United Arab Emirates, the United States of America, South Africa, the European Union, or elsewhere.
9.6 You expressly consent to your DNA Sample being transported by courier or logistics provider across borders and through customs, border control, import/export processes, laboratory intake processes, and related operational processes.
9.7 You acknowledge that different jurisdictions may have different data protection, privacy, health data, laboratory, sample handling, confidentiality, and government access laws from those applicable in the United Arab Emirates.
9.8 We will take reasonable steps to ensure that your Personal Data, Health Data, Genetic Data, and DNA Sample are handled in accordance with applicable privacy, security, confidentiality, contractual, and consent requirements.
9.9 If you do not consent to the cross-border export, transfer, processing, analysis, hosting, storage, or use of your DNA Sample, Personal Data, Health Data, Genetic Data, or related information, we may not be able to provide the products and services to you.
10. AI TOOLS, ZENDESK, AND SUPPORT SYSTEMS
10.1 We use Zendesk or a similar customer support and ticketing platform to manage support requests, technical support, service queries, operational queries, complaints, attachments, account requests, and related communications.
10.2 Information processed through Zendesk or a similar support system may include your name, contact details, account details, order details, sample ID, barcode, support messages, attachments, technical logs, complaint details, and other information you choose to provide or that is necessary to resolve your request.
10.3 We may use ChatGPT or other AI-enabled tools to support internal workflows, customer support drafting, technical support, quality assurance, report workflow support, product improvement, administrative assistance, operational analysis, and service efficiency.
10.4 Where AI-enabled tools are used, we will take reasonable steps to apply appropriate privacy, confidentiality, security, access control, and data minimisation measures, taking into account the sensitivity of the information and the purpose of the processing.
10.5 We will not knowingly use AI-enabled tools to make final autonomous clinical decisions about you. The products and services are non-diagnostic wellness services, and any medical or clinical decision must be made separately by an appropriately licensed healthcare professional.
10.6 AI-enabled tools may generate drafts, summaries, classifications, internal workflow suggestions, or support responses. Human review may be applied where appropriate, particularly for sensitive, complex, or escalated matters.
10.7 If you provide highly sensitive information through support channels, that information may be processed through the relevant support workflow to respond to your request. You should not provide unnecessary sensitive information through general support channels unless it is required for your request.
11. SHARING OF YOUR INFORMATION
11.1 We will not sell your identifiable Genetic Data to advertisers.
11.2 We may share your Personal Data, Health Data, Genetic Data, DNA Sample information, and related information where necessary, lawful, authorised, or consented to in connection with the products and services.
11.3 Recipients may include:
11.3.1 Smart Salem and its authorised personnel;
11.3.2 BioCertica and its authorised personnel;
11.3.3 laboratories and laboratory service providers;
11.3.4 couriers, logistics providers, customs agents, and shipping providers;
11.3.5 cloud hosting providers, data storage providers, software providers, cybersecurity providers, and technology providers;
11.3.6 Zendesk or other customer support and ticketing providers;
11.3.7 ChatGPT or other AI-enabled tool providers used under appropriate operational controls;
11.3.8 payment processors, banks, card processors, and transaction service providers;
11.3.9 Partner Wellness Merchants, but only where you request or consent to Value-Added Services or where otherwise permitted by Applicable Data Protection Laws;
11.3.10 healthcare professionals, Smart Salem professionals, or other providers selected by you or involved in services you request;
11.3.11 professional advisers, auditors, insurers, consultants, legal advisers, and compliance advisers;
11.3.12 regulatory authorities, courts, government authorities, law enforcement authorities, customs authorities, or other competent authorities where required or permitted by law; and
11.3.13 successors, assignees, affiliates, purchasers, investors, or transaction parties in connection with a corporate transaction, restructuring, merger, acquisition, sale of business, or transfer of assets, subject to appropriate confidentiality and legal safeguards.
11.4 We require employees, contractors, and service providers who access your information to do so only where reasonably necessary and subject to confidentiality, security, and access control obligations.
11.5 Where you elect to use Value-Added Services, your Report, Genetic Data, Health Data, or questionnaire information may be shared with a Partner Wellness Merchant to provide the relevant service. If you do not consent to such sharing, you may not be able to access the Value-Added Services.
11.6 Where you request that your Report be shared with a healthcare professional or other third party, we may share the relevant information with that party in accordance with your consent or instructions.
11.7 We may disclose information where required to comply with a legal obligation, court order, warrant, subpoena, regulatory request, customs request, public authority request, legal process, or other lawful requirement.
11.8 We may disclose information where reasonably necessary to enforce this Policy or the Terms of Service, investigate misuse, prevent fraud, protect security, respond to claims, protect rights or property, or protect the safety of users, employees, service providers, or the public.
12. DATA RETENTION, SAMPLE STORAGE, AND DELETION
12.1 We retain Personal Data, Health Data, Genetic Data, DNA Sample information, Reports, support records, consent records, transaction records, and related information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by Applicable Data Protection Laws, laboratory requirements, clinical governance obligations, audit requirements, tax requirements, accounting requirements, customs requirements, dispute requirements, security requirements, or other legal obligations.
12.2 Retention periods may differ depending on the type of information, the purpose of processing, the service provided, the jurisdiction involved, and the applicable legal, regulatory, laboratory, clinical governance, or operational requirement.
12.3 Copies of correspondence, support tickets, emails, logs, consent records, and transaction records may be retained in archives, backups, audit systems, or support systems for recordkeeping, security, legal, and operational purposes.
12.4 Your Report may remain accessible through the Platform for as long as your account remains active and the service remains available, unless deleted, archived, restricted, or retained in accordance with this Policy, the Terms of Service, or Applicable Data Protection Laws.
12.5 Your DNA Sample, biological material, extracted material, raw data, laboratory output, and related data may be retained, destroyed, archived, or stored in accordance with Applicable Data Protection Laws, laboratory requirements, accreditation requirements, clinical governance obligations, consent requirements, dispute requirements, and legal retention requirements.
12.6 Where the products and services require sample storage or custody, samples may be stored for a period required or permitted by law, regulation, laboratory accreditation, operational requirement, clinical governance requirement, or the agreement between Smart Salem and BioCertica.
12.7 Where a DNA Sample or biological material is no longer required and no retention obligation applies, we will take reasonable steps to destroy, de-identify, anonymise, or otherwise securely dispose of it in accordance with applicable procedures.
12.8 If you request deletion of your account or data, we will process the request in accordance with Applicable Data Protection Laws. Deletion may not be immediate and may not apply to information that must be retained for legal, regulatory, laboratory, audit, tax, accounting, dispute, clinical governance, security, or legitimate operational reasons.
12.9 If deletion is not possible because retention is required, we may restrict, archive, minimise, or protect the relevant information until the retention obligation expires.
12.10 Aggregated, anonymised, or de-identified data that does not identify you personally may be retained and used for research, product development, quality assurance, statistical analysis, scientific analysis, operational analytics, and service improvement where permitted by Applicable Data Protection Laws and your consent.
12.11 If you engage a healthcare professional, Smart Salem professional, Partner Wellness Merchant, or third party for additional interpretation or Value-Added Services, that party may be responsible for the lawful retention, storage, and destruction of information you share with them. We may not control their retention practices where they act as independent Controllers.
13. PROTECTION OF YOUR INFORMATION
13.1 We are committed to protecting your Personal Data, Health Data, Genetic Data, DNA Sample information, account information, Report, and related information using reasonable technical and organisational measures appropriate to the nature of the information and the risks involved.
13.2 These measures may include encryption, secure transmission protocols, access controls, role-based permissions, authentication controls, password controls, physical access controls, network security, malware protection, firewalls, backup controls, audit logging, staff confidentiality obligations, supplier contracts, and other reasonable safeguards.
13.3 No method of electronic transmission, internet communication, cloud hosting, courier transport, cross-border transfer, support platform processing, AI-enabled tool processing, or laboratory handling is completely secure.
13.4 You are responsible for maintaining the security of your account, email, phone, device, passwords, login credentials, authentication methods, and any downloaded Report.
13.5 You must notify us promptly if you suspect unauthorised access to your account, Report, device, email, or communication channel.
13.6 Where required by Applicable Data Protection Laws, we will notify you and/or the relevant authority of a personal data breach within the required timeframe and in accordance with applicable legal requirements.
13.7 We may suspend or restrict access to the Platform if we reasonably suspect unauthorised access, misuse, fraud, security risk, or breach of this Policy or the Terms of Service.
14. COOKIES, ANALYTICS, AND SIMILAR TECHNOLOGIES
14.1 We may use cookies, pixels, SDKs, local storage, analytics tools, session tracking, device identifiers, and similar technologies when you access the Platform, website, mobile application, or digital services.
14.2 These technologies may help us manage sessions, remember preferences, recognise returning users, secure the Platform, analyse usage, improve performance, detect fraud, understand product engagement, and improve the products and services.
14.3 Cookies and similar technologies may collect technical information such as IP address, browser type, device type, operating system, approximate location, pages viewed, session duration, referral information, error logs, and interaction information.
14.4 You may be able to configure your browser or device to refuse or limit cookies. However, disabling cookies may limit your ability to use certain features of the Platform.
14.5 Where required by Applicable Data Protection Laws, we will request your consent for non-essential cookies or similar technologies.
15. DIRECT MARKETING
15.1 We may use your contact information to send direct marketing communications only where permitted by Applicable Data Protection Laws and your communication preferences.
15.2 We may send you service-related communications, operational updates, security notices, account notices, sample status updates, Report availability notices, and legal notices without separate marketing consent where such communications are necessary for the products and services.
15.3 We may send marketing communications about similar products and services where permitted by law, where you are an existing customer, or where you have consented to receive such communications.
15.4 You may opt out of direct marketing communications at any time by using unsubscribe links, opt-out functions, account settings, or contacting us through the details in this Policy.
15.5 We will not use your identifiable Genetic Data for third-party advertising without your explicit consent.
15.6 Opting out of marketing does not opt you out of important service, legal, security, or operational communications.
16. YOUR RIGHTS
16.1 Subject to Applicable Data Protection Laws and certain exceptions, you may have rights in relation to your Personal Data.
16.2 These rights may include the right to:
16.2.1 request information about how your Personal Data is processed;
16.2.2 request access to or a copy of your Personal Data;
16.2.3 request correction or rectification of inaccurate or incomplete Personal Data;
16.2.4 request deletion or erasure of Personal Data in certain circumstances;
16.2.5 request restriction of processing in certain circumstances;
16.2.6 object to processing in certain circumstances;
16.2.7 withdraw consent where processing is based on consent;
16.2.8 request data portability where applicable;
16.2.9 object to automated decision-making, including profiling, where applicable;
16.2.10 request information about cross-border transfers and relevant safeguards where applicable; and
16.2.11 lodge a complaint with a competent data protection, consumer protection, healthcare, or other authority where you believe your rights have been infringed.
16.3 Your rights may be limited where we are required or permitted to retain information for legal, regulatory, laboratory, clinical governance, audit, tax, accounting, security, dispute, or legitimate operational reasons.
16.4 To exercise your rights, you may contact us using the details in clause 24. We may request proof of identity before responding to a request.
16.5 We will respond to rights requests within the timeframe required by Applicable Data Protection Laws. Where permitted by law, we may refuse, limit, or charge a reasonable fee for requests that are manifestly unfounded, excessive, repetitive, or unlawful.
16.6 Where Smart Salem is the Controller, BioCertica may refer your request to Smart Salem or assist Smart Salem in responding to your request. Where BioCertica is the Controller for a specific processing activity, BioCertica will respond in accordance with Applicable Data Protection Laws.
17. ACCURACY OF INFORMATION
17.1 You are responsible for ensuring that the information you provide is accurate, complete, current, truthful, and not misleading.
17.2 Incorrect or incomplete information may affect sample linkage, laboratory processing, report accuracy, identity verification, support, delivery, refunds, regulatory compliance, and our ability to provide the products and services.
17.3 You must not impersonate another person, provide another person’s information without lawful authority, or submit a DNA Sample that does not belong to the person identified in the consent and account process.
17.4 We may verify your identity, contact details, consent records, sample linkage, or other information using automated verification, manual review, third-party service providers, Smart Salem records, or other reasonable verification methods.
17.5 If you become aware that information you provided is incorrect, you must promptly correct it through the Platform or contact support.
18. INTERNATIONAL DATA TRANSFERS
18.1 Your Personal Data, Health Data, Genetic Data, DNA Sample, Report, support records, and related information may be transferred, stored, hosted, processed, analysed, or otherwise made available outside the United Arab Emirates.
18.2 International transfers may occur because Smart Salem, BioCertica, laboratories, cloud providers, customer support providers, AI-enabled tool providers, technology providers, logistics providers, payment providers, and other Authorised Service Providers may be located in different jurisdictions.
18.3 Countries involved may include the United Arab Emirates, the United States of America, South Africa, the European Union, and any other jurisdiction where an approved service provider is located.
18.4 We will take reasonable steps to ensure that international transfers are carried out in accordance with Applicable Data Protection Laws, consent requirements, contractual safeguards, confidentiality obligations, information security measures, and other appropriate safeguards.
18.5 Where required, we may rely on your explicit consent, contractual safeguards, adequacy mechanisms, necessity for performance of the products and services, legal compliance, establishment or defence of legal claims, or another permitted transfer mechanism under Applicable Data Protection Laws.
18.6 If you do not consent to the required international transfer of your DNA Sample and related data, we may not be able to provide the products and services.
19. CHILDREN AND LAWFUL REPRESENTATIVES
19.1 The products and services are not intended for use by persons under the age of 18 unless a parent, legal guardian, or other lawful representative provides the required consent and is legally authorised to act on behalf of the minor.
19.2 Where you provide consent on behalf of a minor or another person, you warrant that you have lawful authority to do so and that the information you provide is accurate.
19.3 We may suspend or refuse processing where we are not satisfied that appropriate consent or lawful authority has been provided.
19.4 If you believe that a minor’s information has been provided without appropriate consent or lawful authority, please contact us using the details in clause 24.
20. DE-IDENTIFIED, ANONYMISED, AND AGGREGATED DATA
20.1 Subject to Applicable Data Protection Laws and your consent where required, we may use aggregated, anonymised, or de-identified data for research, development, product improvement, quality assurance, scientific analysis, algorithm improvement, operational analytics, platform testing, reporting improvements, and commercial analytics.
20.2 Aggregated, anonymised, or de-identified data is data that does not identify you personally and is not reasonably capable of being used to identify you when handled in accordance with appropriate controls.
20.3 We may retain and use aggregated, anonymised, or de-identified data after your account is closed or your identifiable Personal Data is deleted, provided that such data no longer identifies you personally and is handled in accordance with Applicable Data Protection Laws.
20.4 We will not intentionally attempt to re-identify anonymised data except where required or permitted for security, legal compliance, data quality, or other lawful purposes.
21. AUTOMATED PROCESSING, PROFILING, AND GENETIC INTERPRETATION
21.1 The products and services involve automated and semi-automated processing of Genetic Data, Health Data, questionnaire data, and related information to generate non-diagnostic wellness insights and Reports.
21.2 Automated processing may include laboratory data processing, variant calling, quality control, imputation, algorithmic interpretation, statistical inference, report assembly, module selection, trait mapping, risk association mapping, pharmacogenomic wellness logic, and digital report generation.
21.3 Automated processing is used to provide the selected products and services and does not create a medical diagnosis or physician-patient relationship with BioCertica.
21.4 Where required by Applicable Data Protection Laws, you may have the right to object to or request information about automated processing. If you object to automated processing necessary for the products and services, we may not be able to provide those products and services.
21.5 We will not knowingly use automated processing to make final autonomous clinical decisions about you.
22. DISPUTE RESOLUTION AND GOVERNING LAW
22.1 This Policy and the processing activities described in this Policy are governed by the laws of the Emirate of Dubai and the applicable federal laws of the United Arab Emirates, without prejudice to any mandatory rights or laws that may apply to you or to a particular processing activity.
22.2 The parties will first attempt to resolve any privacy-related dispute, complaint, or concern informally and in good faith.
22.3 If you have a privacy-related dispute, complaint, or concern, you should contact us using the details in clause 24.
22.4 If the dispute cannot be resolved informally, the courts of Dubai shall have jurisdiction, unless another forum is required by Applicable Data Protection Laws or other mandatory law.
22.5 Nothing in this Policy prevents you from lodging a complaint with a competent data protection, consumer protection, healthcare, or other authority where you believe your rights have been infringed.
22.6 Nothing in this Policy is intended to limit or exclude any mandatory privacy, data protection, consumer, healthcare, or other rights that cannot lawfully be limited or excluded.
23. GENERAL PROVISIONS
23.1 All provisions of this Policy are severable. If any provision is held to be invalid, unlawful, void, or unenforceable, that provision will be treated as deleted or modified to the minimum extent necessary, and the remaining provisions will continue in full force and effect.
23.2 This Policy, together with the Terms of Service, Informed Consent, product-specific consent prompts, and any applicable purchase terms, constitutes the privacy framework applicable to your use of the Smart Salem DNA white-labelled products and services.
23.3 We may update this Policy from time to time. Where required by Applicable Data Protection Laws, we will notify you of material changes or request renewed consent.
23.4 Your continued use of the Platform or products and services after receiving notice of an updated Policy may constitute acceptance of the updated Policy, subject to Applicable Data Protection Laws.
23.5 If there is a conflict between this Policy and a mandatory legal requirement, the mandatory legal requirement will prevail to the extent of the conflict.
24. HOW TO CONTACT US
24.1 If you have questions, complaints, requests, or concerns about this Policy or the processing of your information, you may contact Smart Salem or BioCertica through the customer support channels made available to you.
24.2 Smart Salem contact details:
Smart Salem Medical Center 3 FZ LLCRegistered office: GO9A, Block No. 12, Dubai Knowledge Park, Dubai, UAE, PO Box 25031Email: info@smartsalem.aeWebsite: www.smartsalem.aeTelephone: +971 4 220 0212
24.3 BioCertica contact details:
BioCertica Inc.1013 Centre Road, Suite 403-A, Wilmington, DE 19805, USAEmail: info@biocertica.comWebsite: www.biocertica.com
24.4 Customer support and technical support may be managed through Zendesk or another approved support platform.
24.5 When contacting support, you may be asked to provide your name, contact details, account information, sample ID, barcode, order details, consent details, or other information required to identify and respond to your request.
25. ADDITIONAL INFORMATION
25.1 White-label platform provider: BioCertica Inc.
25.2 Customer-facing UAE provider: Smart Salem Medical Center 3 FZ LLC.
25.3 Category of services: DNA-based lifestyle, wellness, trait, ancestry, nutrition, fitness, weight management, pharmacogenomic wellness, and related non-diagnostic genetic information services.
25.4 The products and services are non-diagnostic wellness information services and are not intended to replace licensed medical advice, diagnosis, treatment, or clinical care.
25.5 Any medical, clinical, or healthcare service must be provided separately by Smart Salem or another appropriately licensed healthcare professional or healthcare facility.
25.6 Support and operational tools may include Zendesk, ChatGPT, cloud platforms, analytics tools, customer support systems, laboratory systems, logistics systems, and other Authorised Service Providers.
25.7 This Policy applies to the Smart Salem DNA white-labelled version of the BioCertica platform unless replaced or supplemented by a newer version.