Privacy Policy
1. Who we are and when this policy applies
Alliance Care Technologies International Limited (“ACT”, “we”, “us”) is registered in Abu Dhabi Global Market (ADGM) under number 6776. Our registered office is Al Khatem Tower, Floor 16, ADGM, Abu Dhabi, UAE.
This policy explains how we handle personal data when you use our website (alliancecaretech.com) and the ACT Catalyst apps Assess, Engage and Encourage, including versions branded for our client organizations (together, the “Services”).
Our role depends on how you access the Services:
| How you use the Services | ACT’s role | Whose privacy notice applies |
|---|---|---|
| Our website, or an account you open directly with ACT | Controller | This policy |
| Through an organization, such as an employer, clinic, gym, insurer or event host | Processor, acting on that organization’s instructions | The organization’s notice; this policy explains how ACT handles data on its behalf |
| Review or follow-up by a healthcare provider | The provider is an independent controller | The provider’s notice |
| Research and anonymized data (Section 6) | Controller, with your separate consent | This policy |
Where we act as a processor, please send rights requests to your organization. If you contact us instead, we will pass your request to them.
2. Information we collect
We collect only what we need to run the Services. Health and wellness data is a special category of personal data and receives extra protection.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone, date of birth, sex, organization, member or employee ID | You or your organization |
| Health and wellness data | Questionnaire answers, vital-sign estimates, heart rhythm recordings, retinal images, posture and movement assessments, body measurements, scores and goals | You, our screening devices, and healthcare providers you are referred to |
| Images and video | Short face video used to estimate vital signs, retinal photographs, movement capture | Our screening tools |
| Connected device data | Sleep, activity and heart rate from wearables you choose to link | The device provider, with your permission |
| Engagement data | Challenges joined, points, display name on leaderboards, messages and reminders | Your use of Engage and Encourage |
| Technical data | Device type, app version, IP address, log and crash data | Your device |
| Website data | Contact form entries, cookie data (Section 12) | You and your browser |
| Payment data | Billing name, address, transaction records; card details are handled by our payment provider and not stored by ACT | You and our payment provider |
We do not use face video or images to identify you or for facial recognition.
3. How we use information and our legal bases
We process health data only with your explicit consent, or where the law requires or permits it. We ask for consents for (a) screening and results, (b) sharing results with a healthcare provider, and (c) research and anonymized data (Section 6). Each is optional and can be withdrawn at any time.
| Purpose | Legal basis | Basis for health data |
|---|---|---|
| Run screenings, show your results, provide Engage and Encourage features | Performance of our contract with you or your organization | Explicit consent (a) |
| Manage accounts, support, service messages | Contract; legitimate interests | Not used, unless needed to answer your request |
| Refer or share results with a healthcare provider you choose | Consent | Explicit consent (b) |
| Give your organization aggregated, de-identified reports | Legitimate interests; the organization’s instructions | Aggregated only, never individual results |
| Monitor quality, accuracy, safety and security of the Services | Legitimate interests; legal obligations for regulated software | Explicit consent (a), or where required by law |
| Research, product development and anonymized datasets | Consent | Explicit consent (c) |
| Marketing to website visitors and business contacts | Consent, or legitimate interests where the law allows | Never used |
| Comply with law and respond to lawful requests | Legal obligation | Where required by law |
Withdrawing consent does not affect processing already carried out. If you withdraw consent (a), we can no longer provide screenings to you. We never use health data for advertising.
4. Wellness screenings and AI-assisted features
Our screenings are wellness tools that help you understand and track general wellbeing. They are not intended to diagnose, treat, cure or prevent any disease, and they do not replace advice from a healthcare professional.
Some features use artificial intelligence, for example to estimate vital signs from a short video, analyze retinal images or movement, or tailor reminders. We tell you when a result is generated by AI or when you are interacting with an automated assistant.
- No significant automated decisions. ACT does not use your results to make decisions about your employment, insurance or access to services, and our client terms prohibit organizations from doing so.
- Human contact. You can contact us or your healthcare provider to ask questions about a result.
- Limits. AI estimates can be inaccurate. If you feel unwell, contact a healthcare professional. In an emergency, call your local emergency number.
5. Age requirement
The Services are intended only for adults aged 18 and over. They are not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18.
Organizations that provide the Services agree to enroll only participants aged 18 or over. We may ask for proof of age.
If we learn that we hold data about anyone under 18, we will delete it promptly.
6. Research and anonymized data
We use your data for research or to create anonymized datasets only if you give separate, explicit, opt-in consent. Saying no does not affect your use of the Services.
With that consent, we may:
- use pseudonymized data (identifiers replaced by codes) to research and improve our Services, including AI models; and
- create anonymized datasets and license them to third parties such as research institutions, healthcare and life sciences companies, and technology partners.
How we anonymize:
- We remove direct identifiers and generalize details such as age and location.
- We release data only in groups of at least 10 people, with larger minimum groups for sensitive data.
- We assess re-identification risk before any release.
- Licensees must agree not to re-identify anyone, link the data to other sources to identify people, or pass it on without our approval.
Anonymized data no longer identifies you and is not personal data. If you withdraw consent, we stop using your data for these purposes and delete pseudonymized research copies, but we cannot remove data from anonymized datasets already created.
Where you use the Services through an organization, we use your data this way only if the organization permits it and you consent to ACT directly.
We do not sell personal data or consumer health data.
7. How we share information
We share personal data only as described below. Your employer or other organization never receives your individual results.
| Recipient | What they receive | Why |
|---|---|---|
| Your organization (if applicable) | Aggregated, de-identified reports with minimum group sizes | Program reporting |
| Healthcare providers you choose | Your results and relevant details | Review, follow-up or referral, with consent (b) |
| Service providers, such as cloud hosting, payment, messaging and support | Only what they need to provide their service | Operate the Services, under contracts that require confidentiality and security |
| Device and app partners you link | Data you ask us to send or receive | Your instruction |
| Licensees of anonymized data | Anonymized data only | Section 6 |
| Regulators, courts, law enforcement, professional advisers | What the law requires or permits | Legal compliance, safety reporting for regulated software, protecting rights |
| A buyer or successor of ACT’s business | Data needed to continue the Services | A merger, acquisition or reorganization, with this policy’s protections continuing |
A current list of our sub-processors is available on request.
8. Where your data is stored and international transfers
We host the Services with established cloud providers, currently Amazon Web Services (AWS), Microsoft Azure and Google Cloud, using data centers in the UAE, the EU and the US. Your data is stored in the region assigned to your organization or country.
- UAE. Health data relating to services in the UAE is stored and processed in the UAE. It leaves the UAE only where UAE health data law permits, and a copy is always kept in the UAE.
- EU. Data of participants in the EU is stored in our EU region. Transfers outside the EU rely on an adequacy decision or Standard Contractual Clauses, with additional safeguards where needed.
- US. Data of US participants is stored in our US region.
- Other transfers. Where support staff or service providers access data from another country, we use safeguards recognized under ADGM, EU and other applicable law.
9. Retention and security
We keep personal data only as long as needed for the purposes in this policy, then delete or anonymize it. Periods below align with ACT’s Data Retention Policy.
| Data | Retention period |
|---|---|
| Raw face video used for vital-sign estimates | Deleted within 60 min after analysis |
| Screening results, images and assessments | Length of the program or account, plus 5 years, unless you ask us to delete them sooner |
| Account and contact data | Life of the account, plus 12 months |
| Consent and authorization records | 6 years |
| Website enquiries and marketing contacts | 24 months after last contact |
| Technical logs | 12 months |
| Payment and tax records | As tax law requires, currently 5 years |
Where a healthcare provider holds your data as an independent controller, its own retention rules apply.
We protect data with encryption in transit and at rest, separation of each organization’s data, least-privilege access with multi-factor authentication, audit logging, regular security testing, and staff confidentiality obligations. If a breach affects your data, we will notify the relevant regulator and you where the law requires.
10. Your rights
Depending on where you live, you can ask us to:
- access your data and receive a copy, including in a portable format;
- correct inaccurate or incomplete data;
- delete your data;
- restrict or object to certain processing;
- withdraw any consent at any time; and
- review any decision made solely by automated means.
To make a request, email privacy@alliancecaretech.com or use the Contact Us feature in the app. An authorized agent may request on your behalf. We will verify your identity and respond within one month, or the shorter period local law sets. We may extend this where the law allows and will tell you why.
If we decline a request, we will explain why and how to appeal. We will not treat you differently for exercising your rights. You can also complain to a data protection regulator (Section 11).
11. Regional information
UAE and ADGM
ACT is regulated by the ADGM Data Protection Regulations 2021. You can complain to the ADGM Office of Data Protection. Where we process data of people in the UAE outside ADGM, we also follow the UAE Personal Data Protection Law where it applies and UAE health data law. Our Data Protection Officer is Wojtek Bulatowicz.
EU and UK
The EU General Data Protection Regulation applies to participants in the EU. Our EU representative is Wojtek Bulatowicz. You can complain to the data protection authority in your country.
United States
- State privacy laws. Section 2 lists the categories of personal information we collect and their sources, Section 3 the purposes, and Section 7 the recipients. We do not sell or share personal information for cross-context behavioral advertising, and we use sensitive personal information only to provide the Services. We honor Global Privacy Control signals.
- Consumer health data. Residents of Washington, Nevada and other states with consumer health data laws should read our Consumer Health Data Privacy Policy.
- HIPAA. Where we provide the Services to a healthcare provider or health plan covered by HIPAA, we act as its business associate and its Notice of Privacy Practices applies.
12. Cookies and similar technologies
We use only essential cookies unless you agree to more. You can change your choice at any time through the cookie settings link in the website footer.
| Type | Purpose | Your choice |
|---|---|---|
| Essential | Security, load balancing, login, remembering your cookie choice | Always on |
| Analytics | Understanding how visitors use the website, in aggregate | Off until you opt in |
| Marketing | Recognize returning visitors, associate activity with CRM contacts, and measure marketing interactions | Always on |
| Functional | Remember preferences and support website features | Always on |
The apps use device storage only to keep you signed in and the app working. We do not use health data for analytics or advertising.
13. Changes and contact
We will post any update to this policy here with a new effective date. For material changes, we will notify you in the app or by email before they take effect. Where a change needs your consent, we will ask for it.
Effective date: October 30, 2026
Contact: Data Protection Officer, Alliance Care Technologies International Limited, Al Khatem Tower, Floor 16, ADGM, Abu Dhabi, UAE. Email: privacy@alliancecaretech.com