سياسة الخصوصية | Privacy Policy

PART (B) — PRIVACY POLICY (English — convenience translation)

The KetoArab app is a wellness and nutrition tool. This policy explains what data we collect, how we process and protect it, and your rights under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and its Executive Regulations, and the applicable data-protection laws of the user’s country of residence. The health inputs in the app are optional, self-reported, under your control, and deletable at any time.

1. Who we are / Data Controller

The KetoArab app ("the App"), operated by HLUL ZAD FOR INTERNET CONTENT PROVIDER, registered in Dubai, United Arab Emirates under Commercial Register No. 1216260, is the Data Controller for the processing of your personal data under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and its Executive Regulations, and the applicable data-protection laws of the user’s country of residence. Privacy contact / rights requests: [email protected].

2. What data we collect

Items marked (optional) are optional, self-reported health inputs you provide yourself. They are legally classified as sensitive data requiring your separate explicit consent before collection; you may withhold or delete them without losing access to core features.

(a) Account & identity (ordinary): first/last name; email, phone; date of birth (age is derived, not stored separately), gender, country, marital status, referral source, language, timezone.

(b) Optional health inputs you provide (legally classified as sensitive): weight, height, body-fat %, activity/exercise level; pregnancy / breastfeeding / Nifas status; medication use, medications, health conditions (e.g. diabetes, PCOS, thyroid); menstrual-cycle data (settings, cycle dates, symptoms); weight logs and body measurements (circumferences); progress photos (body images); food/meal logs, food photos, and macros; habits, mood/energy, fasting, water intake, nutrition goals.

(c) Usage & device: platform and device identifier, a device registration token for push notifications via Firebase Cloud Messaging, and an advertising identifier (Advertising ID) when non-personalized ads are shown; access/audit logs.

(d) Payment data (once paid subscriptions launch): payment-provider customer ID and subscription data — we do not store card details (handled by the payment provider).

3. Lawful basis

• Separate explicit consent per category of optional health input, collected separately before any health-data collection. These consents are independently withdrawable per category: basic health_metrics are needed to run the health features, while reproductive-health, menstrual-cycle, progress-photos, and coaching-data are optional, separate consents you may grant or withdraw individually without affecting the others.
• Contract / service delivery to run your account and core features.
• Separate ordinary consent for marketing (optional; sensitive data is never used for marketing).

4. How we collect & record consent

A consent screen is shown before any health-data collection, with separate opt-ins per category (no bundling). We record, in an immutable consent ledger: the category, status (granted/withdrawn), lawful basis, policy version, a SHA-256 hash of the exact consent text shown, locale, and timestamp. You can withdraw consent as easily as you gave it, per category.

5. Processing purposes

• AI nutrition: we analyse your health context and food photos on a server inside our own infrastructure. When the meal features (recipes, plans and shopping lists) are switched on, de-identified meal data (no name, contact detail or any identifier) may be sent to an external AI provider under contractual data-protection terms. Your personal health data and your photos are never sent to any external provider.
• Human coach: an assigned coach may view your authorized health context. In cross-gender coaching, photo sharing is hard-blocked and only numeric measurements are exchanged.
• Gamification: points/achievements to encourage adherence.

6. How your health inputs are used (and what we do NOT do)

The health inputs you provide are used only to personalize your own experience (meal suggestions, reminders); the AI runs on our own servers; your health data is never sold and never used for advertising.

We use no third-party analytics tools; any ads we show are non-personalized, and your health data is never used to target you with ads and is never shared for advertising purposes.

7. Third parties / sub-processors

We rely on our own infrastructure, and use external providers only within the narrow limits described below:

1) Our own infrastructure — self-hosted on our own servers: your data stays on our own infrastructure and is not shared with external parties, except the providers listed in (2) below, each limited to the purpose shown; this is itself a stronger privacy position.

2) External providers we genuinely use: (a) WhatsApp / Meta, to deliver the one-time login code (OTP) to your phone number, (b) Google Firebase Cloud Messaging, to deliver push notifications to your device, and (c) an external AI provider, for the meal features (recipes, plans and shopping lists), which receives de-identified meal data only; the app may also show non-personalized ads during the initial phase (see "Advertising" below).

Push notifications (Google Firebase Cloud Messaging): We use Firebase Cloud Messaging (FCM), provided by Google LLC, to deliver push notifications to your device (e.g. reminders and app updates). For this purpose the app generates a registration token that Google uses to route notifications to your device; Google may process device identifiers and service-operation data as a data processor under the Firebase Data Processing and Security Terms. We never include health or otherwise sensitive data in notifications. You can disable notifications at any time in your device or app settings.

Social Media Integrations & Automated Messaging (Meta / Facebook / Instagram): When you interact with KetoArab’s official accounts on Meta platforms (such as commenting to request recipe ingredients or inquiring about macronutrient breakdowns), we process public interaction identifiers (username and public comment ID) solely through official Meta APIs to automatically deliver the requested recipe links and nutritional breakdown via comments or direct messages. We do not retain private messaging for advertising purposes, nor do we sell or disclose your data to third parties. You may request deletion of any interaction data at any time via our Account & Data Deletion page.

Advertising: The app may be ad-supported during the initial phase (until paid subscriptions launch). Ads are served by an external ad provider that may process an advertising identifier (Advertising ID) and basic device information to display ads, measure performance, and prevent fraud. The ads we show are non-personalized (contextual), and we do not build an advertising profile about you. Your health or otherwise sensitive data is never shared with any ad provider and is never used to target you with ads. You can reset the advertising ID or limit ad tracking in your device settings.

Online card payment is not currently active (launch uses a voucher/code model). If card payment is enabled in future, a PCI-DSS-compliant payment processor will be added and disclosed here.

We use no third-party analytics SDK (e.g. Google Analytics or Mixpanel); any ads shown are non-personalized (contextual) and do not use your health data.

8. Cross-border transfer

Our external providers may process some data outside the United Arab Emirates: WhatsApp / Meta (your phone number and login code, to deliver the code), Google (device identifiers and the registration token, to deliver push notifications, as a data processor), the ad provider (advertising ID, to serve non-personalized ads), and the AI provider (de-identified meal data, for the meal features). Any transfer outside the UAE is subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its Executive Regulations, with appropriate safeguards under the UAE PDPL.

9. Your rights

Right to be informed, access, obtain a copy, correct, destroy/delete, withdraw consent, object/portability.

• Access/copy: we export your data via a comprehensive export registry covering dozens of tables (health, food, weight, measurements, cycle, photos, consents, etc.).
• Deletion: on request we delete non-retained data and anonymize shared content, except records under statutory retention (see §10).
• In-app account deletion is offered.
• Withdraw consent as easily as given, per category.

10. Retention & destruction

Non-financial data is deleted within 30 days of the request; financial/tax records are retained for the period required by applicable UAE law; conversation logs are automatically swept after 30 days.

• Financial/tax records: retained for the period required by applicable UAE law and not deleted by a deletion request.
• Consent records: kept as compliance evidence (RoPA).
• Conversation logs: automatically swept after 30 days by a scheduled job.

11. Security

Technical & organizational controls (on-prem image storage, time-limited links, authentication, immutable audit log, Row-Level Security ENABLED). This does not remove your duty to protect your credentials.

12. Breach notification

If a breach occurs that may harm your data or rights, we notify the competent UAE data-protection authority (UAE Data Office) without undue delay of becoming aware, and notify you where required.

13. Children

The App is not directed to anyone under 18. We do not knowingly collect children’s data.

14. Important medical disclaimer

The App is a general wellness/nutrition tool, not a medical device; it provides no diagnosis, treatment, or medical claims. Consult your physician before any dietary change, especially during pregnancy/breastfeeding/Nifas or with a medical condition. Read the full Medical Disclaimer.

15. Contact & changes

Questions: [email protected]. We may update this policy and publish a new version/date. Governing law & venue: United Arab Emirates (Emirate of Dubai).