Privacy Policy
Last updated: 22 October 2026
This Privacy Policy explains what personal data Hudhud collects, why, how long we keep it, who we share it with, and the choices and rights you have. It applies to the Hudhud website at hudhudhealth.ae, the Hudhud WhatsApp number, our alert messages and emails, and every related service (the "Service").
It should be read together with our Terms of Use. Words defined in the Terms of Use have the same meaning here.
We have written it to describe what the Service actually does. If we change what we collect or how we use it, we will update this policy.
1. Who we are
1.1 The Service is operated by Jasmine Entertainment FZE LLC, Publishing City, Business Center, Sharjah, United Arab Emirates ("Hudhud", "we", "us", "our").
1.2 For the personal data described in this policy, we are the controller: we decide why and how it is processed.
1.3 For any question about privacy, or to use any of your rights, write to [email protected].
2. The short version
- You can read every page without giving us anything. We run no advertising or analytics trackers, and we set no cookie when you only read, apart from one that remembers your language if you switch it and any strictly necessary security cookie set by our network provider.
- If you set an alert, we keep the WhatsApp number or email address you give us so that we can send the alerts you asked for. You can stop them at any time.
- If you message a clinic through the Hudhud WhatsApp number, we keep a one-way hash of your number, your WhatsApp first name (if shown), your message and the clinic you asked about. We erase your actual number from our live systems within five days, or straight away if you reply STOP or PAUSE, and we give it to the clinic only if the clinic has added its WhatsApp number with us. We never pass your own words on to the clinic.
- If you run a clinic, we keep the contact details you give us, and Stripe handles your payments.
- We do not sell your personal data, and we do not use it for advertising.
- Please do not send us health information. We do not need it and do not ask for it.
3. What we collect, and why
3.1 If you only read the Service
| What | Why | Legal basis |
|---|---|---|
A language cookie (sahm_lang), only if you switch language | To show you the language you chose | Necessary for a feature you asked for |
| Technical data your browser sends with every request, such as IP address, browser type, the page requested and the time, which pass through our hosting and security providers | To deliver pages, keep the Service secure and stop abuse | Our legitimate interests in running and securing the Service |
| A count of clicks on a clinic's "Website" button, stored as the clinic, the day (in Dubai time) and a number | To show clinics how many people looked for them | Contains no personal data: no cookie, no IP address and no identifier is stored with the count |
We do not use advertising pixels, analytics tools, social-media trackers or fingerprinting on the Service.
3.2 If you set an alert
| What | Why | Legal basis |
|---|---|---|
| The WhatsApp number or email address you give us, as you typed it, and a one-way hash of it | To confirm it is yours and send the alerts you asked for | Your consent, and performing the service you requested |
| The language you chose and the time you confirmed | To write to you in your language and to record your consent | Your consent; our legal obligations to keep a record of consent |
| What you asked us to watch (for example a price, a stock status or an availability), and a record of each alert we send you | To send the right alerts, avoid sending duplicates, and handle complaints | Performing the service; our legitimate interests |
| Confirmation codes, kept only as hashes | To confirm your number or address | Performing the service |
Two cookies: hh_sub, a signed cookie that remembers your alerts on this device for up to one year, and hh_pend, which lasts 30 minutes while you confirm a code | To let you manage your alerts on this device without an account | Necessary for a feature you asked for |
3.3 If you message a clinic through the Hudhud WhatsApp number
When you tap a clinic's WhatsApp button, you write to the Hudhud number, not to the clinic. When your message arrives, we collect:
| What | Why | Legal basis |
|---|---|---|
| Your WhatsApp number | To reply to you with a link to the clinic, to pass to the clinic (only if the clinic has added its WhatsApp number with us, see section 5.1), and to send one follow-up message about three days later | Your explicit consent, given when you send the message (see 3.3.1); performing the service you requested |
| A one-way hash of your number | To recognise a repeat message about the same clinic within 30 days, to count a clinic's free messages fairly, and to prevent abuse | Our legitimate interests; performing our agreement with clinics |
| The first name shown on your WhatsApp profile, if any | To address you in our reply and to keep the chat record | Your consent |
| The words of your message, the clinic and service you asked about, the language, and the times of each step (for example when you tapped the link to the clinic and how you answered the follow-up) | To route your request, keep a record of it, count a clinic's free messages and produce anonymous monthly statistics for clinics | Your consent; our legitimate interests; performing our agreement with clinics |
| The raw message as Meta delivers it to us | To process it reliably | Performing the service |
3.3.1 Health-related information. The fact that you asked a clinic about a particular treatment or medicine (for example a weight-loss programme) may reveal something about your health. We treat it as sensitive personal data. By sending a message to the Hudhud number about a clinic, you give us your explicit consent to process that information, and your number, for the purpose of connecting you with that clinic as described in this policy. You can withdraw that consent at any time (section 9); withdrawal does not affect what we did before.
3.3.2 Please do not send us health details. Do not send us symptoms, diagnoses, prescriptions, test results, photographs or identity documents. We do not need them, we do not pass your own words to clinics, and we may delete such information when we see it.
3.4 If you run or act for a clinic
| What | Why | Legal basis |
|---|---|---|
| The clinic's business contact details from its own public pages (such as its published email address and website) | To list the clinic and to tell it when someone asks about it | Our legitimate interests in running an accurate directory |
| The WhatsApp number and email address you give us on the claim page, and the time you agreed to receive lead cards | To send lead cards, confirmations and monthly statistics, and to record the clinic's consent | Consent; performing our agreement with the clinic |
| Stripe customer and subscription identifiers, plan and status | To run the subscription and switch the WhatsApp button on or off | Performing our agreement with the clinic; legal obligations (tax and accounting) |
| A removal request or licence-number message: your email address, the facility, the text you wrote and what we decided | To review the request, reply to you, and keep a record that it was made and how it was handled | Our legitimate interests; legal obligations |
Card details are entered directly with Stripe and never reach us.
About clinic staff and doctors. We do not collect or publish personal data about doctors or other healthcare professionals. We do not search professional registers for individuals. To read a clinic's prices and services, we store a copy of the text of its public web pages as they were fetched; that text may incidentally contain names of the clinic's staff that the clinic itself published. We keep those copies only to show where a fact came from and to detect changes, and we do not extract, display or use the names. A professional who wants a copy removed can write to us.
3.5 If you write to us
If you email us, we keep your email address, your message and our reply, to answer you and to keep a record of the conversation. Legal basis: our legitimate interests, and our legal obligations where a request concerns your rights.
3.6 Security and abuse prevention
To limit how many messages one number or address can trigger, and to stop abuse of our confirmation codes, we log a hash of the number or address, the requester's IP address, the kind of message and the time, and we keep a keyed hash of an IP address that fails confirmation repeatedly. Legal basis: our legitimate interests in protecting the Service, our users and clinics from abuse.
4. How we use personal data
We use personal data only to:
(a) provide the Service you asked for, including alerts and connecting you with a clinic;
(b) operate clinic subscriptions, lead cards and monthly statistics;
(c) communicate with you about the Service, including confirmations and important notices;
(d) keep the Service secure, prevent fraud, spam and abuse, and enforce our Terms of Use;
(e) handle requests, complaints and disputes;
(f) comply with law, and respond to lawful requests from courts, regulators and authorities; and
(g) produce statistics that do not identify anyone.
We do not use your personal data for advertising, we do not build profiles of you for marketing, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
Automated processing of public information. We use software, including artificial-intelligence models, to read clinics' public web pages and public registers and to decide what to publish about clinics (for example a price, or a register indication). These decisions concern businesses, not individuals. The AI models receive the text of public pages and nothing about you.
5. Who we share personal data with
5.1 Clinics you contact
If you message a clinic through the Hudhud number:
- If the clinic has added its WhatsApp number with us, it receives a WhatsApp card with the service you asked about, the area, a reference code and a link that opens a chat with you. That link contains your WhatsApp number.
- If the clinic has only an email address, it receives an email with the service you asked about and a reference code, without your number or your name.
- We never pass on the words you wrote.
Once a clinic has your number, or once you start a chat with the clinic yourself, the clinic is responsible for how it uses your data, as an independent controller under its own privacy policy. We are not responsible for what a clinic does with your data.
5.2 Service providers
We use the following providers to run the Service. They process personal data on our behalf and under our instructions, or as independent providers of the service you use, and only as needed for their part:
| Provider | What they do | Data involved |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Carries WhatsApp messages between you, us and clinics | WhatsApp numbers, profile names, message content and delivery data |
| Resend | Sends our emails | Email addresses and email content |
| Stripe | Processes clinic payments and subscriptions | Clinic billing details, card data (held by Stripe only) |
| Railway | Hosts our servers and database | All data we store |
| Cloudflare | Delivers the website, protects it from attacks, and handles our incoming email | IP addresses and request data; emails sent to us |
| Anthropic, Google and OpenAI | AI models that read clinics' public web pages | Public page text only, no visitor or user data |
| Our mailbox provider | Stores emails sent to [email protected] after Cloudflare forwards them | Your emails to us |
We may change providers. We will update this table when we do.
5.3 Other disclosures
We may disclose personal data:
(a) where required by law, regulation, court order or a lawful request from a competent authority;
(b) to protect the rights, property or safety of Hudhud, our users, clinics or the public, including to prevent fraud or abuse;
(c) to our professional advisers (such as lawyers and accountants) under a duty of confidentiality; and
(d) to a buyer, investor or successor in connection with a merger, acquisition, financing or sale of all or part of our business, who will be bound to respect this policy.
We do not share personal data with anyone else for their own marketing.
6. International transfers
Some of our providers store or process data outside the United Arab Emirates, including in the United States and the European Union. We transfer personal data outside the UAE only where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data permits it, including to countries with an adequate level of protection or under contractual safeguards with the provider. We do not treat your use of the website as consent to transfer. Where the law requires particular health-related data to be stored in the UAE, we will store it in the UAE.
7. How long we keep personal data
| Data | How long |
|---|---|
Language cookie (sahm_lang) | Up to 1 year on your device |
Alert device cookie (hh_sub) | Up to 1 year on your device |
Pending confirmation cookie (hh_pend) | 30 minutes |
| Confirmation codes (hashed) | Deleted 1 day after they expire |
| Your alert number or address, your watches and the record of alerts sent | While your alerts are active, and afterwards until you ask us to delete them |
| Your actual WhatsApp number when you message a clinic | Only where we need it (chats we pass to a clinic, and chats still waiting for you to tap the link to the clinic), until we send the day-3 follow-up, and never longer than 5 days. Replying STOP or PAUSE erases it at once. (One exception: if a lead card is already queued for the clinic at that moment, the number stays until that card is sent, normally within a minute, and is then erased.) After that it is gone from our live database; copies may remain in our hosting provider's backups for a limited period until they are overwritten, and are not used. Meta, as the WhatsApp provider, keeps its own copies under its own terms. |
| The raw message Meta delivers to us | Emptied once handled, or 5 days after we stop trying to handle it |
| The chat record: hashed number, WhatsApp first name, your message, the clinic, service, language and times | While the Service runs, or until you ask us to delete it |
| Throttle and abuse logs (hashed number or address, IP address, kind, time) | 30 days |
| Clinic contact details, consent records and subscription identifiers | While the clinic is listed or subscribed, and afterwards as long as needed for legal, tax and accounting purposes |
| Removal requests and licence-number messages | Kept as the record that the request was made and how it was handled |
| Emails you send us | As long as needed to deal with them, and afterwards as needed to defend legal claims |
| Payment and invoice records | As long as UAE tax and commercial law requires (generally at least 5 years) |
When we no longer need data, we delete it or make it anonymous. Backups are overwritten on a rolling cycle.
8. How we protect personal data
We use technical and organisational measures appropriate to the risk, including: encryption in transit (HTTPS); storing hashes instead of numbers and addresses where we can; signed cookies; access controls on our database and administrative tools; rate limits and abuse controls; and keeping the data we collect to a minimum. No system is completely secure, and we cannot guarantee the security of data sent over the internet or through third-party services such as WhatsApp. If a personal-data breach is likely to put your rights at risk, we will notify the UAE Data Office and you where the law requires.
9. Your rights
Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and subject to its conditions and exceptions, you have the right to:
(a) access the personal data we hold about you, and get information about how we process it;
(b) correct inaccurate or incomplete personal data;
(c) delete your personal data;
(d) restrict our processing in certain circumstances;
(e) object to processing based on our legitimate interests, and to any direct marketing;
(f) receive your personal data in a structured, machine-readable form and have it transferred to another controller, where technically feasible (data portability);
(g) withdraw your consent at any time, without affecting processing that happened before; and
(h) complain to the UAE Data Office.
How to use them.
- To stop alerts, use the alerts page or reply STOP to any WhatsApp message (reply PAUSE to stop for a week), or use the link in any alert email.
- For anything else, write to [email protected] and tell us the number or email address you used, so we can find your data. We may ask you to prove that the number or address is yours before we act, for example by sending a code to it.
- We will reply within the time the law requires, and aim to reply within 30 days, free of charge, unless a request is clearly unfounded or excessive.
- Because we store a hash of your number rather than the number itself after a few days, we can find your chat record only if you give us the number you used.
If you are in the EU, the UK or another region with its own data-protection law, you may have similar rights under that law, and you may complain to your local data-protection authority. Write to us and we will deal with your request under the law that applies.
10. Children
The Service is for adults. You must be 18 or older to set an alert, message the Hudhud number or submit a form. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.
11. Cookies
We use only the cookies needed for features you choose. We do not use advertising, analytics or tracking cookies, and we do not allow third parties to set cookies on the Service.
| Cookie | Set when | Purpose | Lasts |
|---|---|---|---|
sahm_lang | You switch language | Remembers your language | Up to 1 year |
hh_sub | You confirm an alert | Remembers, on this device, which alerts are yours so you can manage them; signed so it cannot be forged | Up to 1 year |
hh_pend | You start confirming an alert | Holds the pending confirmation while you enter the code | 30 minutes |
Our security provider (Cloudflare) may set strictly necessary cookies to tell people from bots and protect the Service from attacks.
You can delete or block cookies in your browser settings. If you block them, the language switch and alert management on that device will not work.
12. Links to other websites and services
The Service links to clinic websites, public registers and other sites, and connects you to clinics on WhatsApp. Those sites and services have their own privacy policies, and we are not responsible for them. Your use of WhatsApp is also governed by WhatsApp's own terms and privacy policy.
13. Changes to this policy
We may update this policy. We will publish the new version on the Service with a new "Last updated" date. If a change is material, we will take reasonable steps to tell you before it takes effect, for example by a notice on the Service, or by message where we hold your contact details and the change affects you.
14. Language
This policy is written in English and may also be provided in Arabic. If there is any conflict between the two, the English version prevails, to the extent permitted by law.
15. Contact
Jasmine Entertainment FZE LLC
Publishing City, Business Center
Sharjah, United Arab Emirates
Email: [email protected]