United Arab Emirates (UAE) Privacy Notice

ComPsych International (“ComPsych”) values your privacy. This Privacy Notice provides information about the personal information that we collect and process when interacting with you to provide services. Through this Notice, we are also fulfilling our legal notification obligation as we are committed to processing your personal data according to the applicable privacy and data protection laws, including the UAE Federal Law 45 of 2021 on the Protection of Personal Data, UAE Federal Law 2 of 2019 on the Use of Information and Communication Technology (ICT) in Health Fields and with Standards issued by Health Authorities.

This Notice applies to all individuals receiving services from ComPsych and its affiliates and provides you with information related to ComPsych’s collection or processing of personal information about you, how and why we are using your information and your rights under data protection laws.

Unless otherwise stated, all personal information we request from you is necessary for the purpose of providing you with services and for the other purposes set out in this Notice.

DEFINITION OF TYPES OF PERSONAL INFORMATION

Depending on our relationship with you, we might hold different categories of personal information. The term "Personal Information" in this notice refers to information that enables us to identify you as a natural person such as your full name, address, telephone number and email address.

HOW WE COLLECT YOUR PERSONAL INFORMATION

The Personal Information that ComPsych processes is information we have obtained from you or collected with your consent from a third party to allow us to provide services to you. Sensitive Personal Information about you, as defined below, may be collected and processed by ComPsych to the extent necessary to provide services to you.

PURPOSES AND LEGAL BASIS FOR PROCESSING YOUR DATA

The Personal Information held by ComPsych is collected and processed solely to provide the information and services offered by our employee assistance programs. We also use this data to: (a) to manage and administer employee assistance programs, behavioral health programs, work-life services, and health and wellness programs; (b) to communicate with you; (c) to provide customer service or technical support; (d) to assess and improve the quality of our website, products, services and business operations; (e) to satisfy governmental reporting and tax requirements; (f) to address security, health, and safety concerns; (g) to plan and implement potential acquisitions and mergers; and (h) for other business-related purposes permitted or required under applicable local laws and regulations.

In the case of Sensitive Personal Information (which means Personal Information that discloses family, racial or ethnic origin, political opinions, religious or philosophical beliefs, health, genetic or biometric data, physical or mental health), we process this information either (i) because we have your consent to do so, (ii) because we are required to process the information to comply with applicable laws, or (iii) because processing is necessary for the provision of services to you.

ComPsych may process Personal Information and/or Sensitive Personal Information where such processing: (a) is based on your consent; (b) is vital to your interests or the interests of another person; (c) is necessary for the establishment of legal claims or defenses, to obtain legal advice, or for the purposes of establishing, exercising or defending ComPsych’s legal rights; (d) is required to provide behavioral and medical care or diagnosis; (e) is necessary to carry out ComPsych’s obligations under applicable law; (f) is necessary for specified public health activities and purposes; (g) is data manifestly made public by the data subject; (h) is required by law enforcement officials or public authorities in response to a lawful request made pursuant to national security interests or law enforcement requirements; or (i) as otherwise required or permitted by law.

When we process your Personal Information and Sensitive Personal Information on the basis of your consent, you may withdraw that consent at any time by contacting our Privacy Official. If you withdraw your consent, we may still be required to process your Personal Information and Sensitive Personal Information to comply with applicable law, but we will explain to you at the time your consent is withdrawn what processing activities will continue for legal compliance purposes.

You may obtain additional information about the processing of your Personal Information, including Sensitive Personal Information, by contacting our Privacy Official at privacyofficial@compsych.com.

CHANGE OF PURPOSE

We will only use your Personal Information for the purposes for which we collected it, as specified above, or when reasonably compatible with the original purpose for which the information was collected.

If we need to use your Personal Information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We may process your Personal Information without your knowledge or consent, in compliance with the law, where this is required or permitted by applicable laws.

DISCLOSURE AND SHARING OF INFORMATION

From time to time, we outsource the processing of certain functions and/or information to third parties. When we do outsource the processing of your Personal Information to third parties or provide your Personal Information to third-party service providers, we oblige those third parties to protect your Personal Information with appropriate security measures in accordance with our Privacy and Data Protection Policy and to at least the same level that we do.

International transfers

Like most international businesses, we have centralized certain aspects of our data processing and clinical resources administration in accordance with applicable laws in order to allow us to better manage our business. That centralization may result in the transfer of de-identified and anonymized Personal Information from one country to another. You can expect a similar degree of protection of your Personal Information in the destination country as can be expected in the country of where services were provided.

CONSENT

Generally, ComPsych is not required to obtain your consent to collect and use your Personal Information for the purposes specified in this Notice, unless specifically required by applicable laws, in which case we will not process your Personal Information without your consent.

USE OF YOUR PERSONAL INFORMATION IN AUTOMATED DECISION MAKING AND DIRECT MARKETING

ComPsych does not make use of automated decision making that would affect you as the data subject in any significant way, or have any legal consequences attached to it. Additionally, we do not process Personal Information for the purposes of direct marketing.

DATA SECURITY

Your personal information shall be treated as confidential and collected, processed, and stored by ComPsych and our service providers in a manner that ensures appropriate security thereof, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organizational measures, which include:

identity and access management;
infrastructure and operations security;
vulnerability management;
business continuity planning
disaster recovery planning; and
security awareness.

Further details of these measures are available upon request.

We have put in place procedures to deal with any suspected data security breaches and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

DATA RETENTION

We will retain your Personal Information for no longer than is necessary or permitted by applicable law.

In some circumstances we may anonymize your Personal Information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

YOUR RIGHTS OF ACCESS, CORRECTION, ERASURE AND RESTRICTION

You may request to access, correct, erase, or restrict our processing of your Personal Information in accordance with applicable law. When making a request, we will need specific information from you to help us confirm your identity and ensure your right can be exercised.

Contact ComPsych’s Privacy Official at privacyofficial@compsych.com for additional information related to your rights or to make a request.

You will not have to pay a fee to confirm whether ComPsych holds Personal Information about you or when requesting a copy of your records per the regulatory policies. We may refuse to disclose any information should your request for access clearly be unfounded, repetitive or excessive.

Where you provided consent to the collection, processing, and transfer, you have the right to withdraw your consent for that specific processing at any time, as far as it complies with laws and regulations. If you withdraw your consent, we may still be required to process your Personal Information and Sensitive Personal Information to comply with applicable law, but we will explain to you at the time your consent is withdrawn what processing activities will continue for legal compliance purposes.

To withdraw your consent, please contact ComPsych’s Privacy Official at privacyofficial@compsych.com.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

CHANGES TO THIS PRIVACY NOTICE

ComPsych reserves the right to revise this Notice to ensure compliance with applicable law and regulatory guidance at any time. Revised notices will be posted on our website. We may also notify you in other ways from time to time about the processing of your personal information.

QUESTIONS

If you have any questions about this privacy notice, our lawful reason to process or how we handle your Personal Information, please contact our Privacy Official at privacyofficial@compsych.com.

REGULATOR

ComPsych welcomes communication from you related to this Notice, your rights and any comments or complaints you may have related to the privacy of the Personal Information we process about you. If you are not satisfied with our response or believe that we are not processing your data in accordance with the law, you may file a complaint with the UAE data protection authority

UAE Data Office: not yet established; for news please consult https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws

Dubai Health Authority: Contact toll free number 800DHA or email to MC_HRS@dha.gov.ae

Abu Dhabi Department of Health: Contact DOH customer service department on 800555 or using TAMM portal or registering at DOH portal

Ministry of Health and Prevention: info@mohap.gov.ae