Millennium Hospital L.L.C. (“Millennium Hospital”, “we”, “us”) is the data controller for personal data collected through millenniumhospital.ae. We are a healthcare facility licensed by the Department of Health – Abu Dhabi (DOH licence no. MF4838) and part of Ahalia Medical Group.
This policy is issued in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) and its Executive Regulations, UAE Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields, the DOH Standard on Patient Healthcare Data Privacy, and the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS).
Scope. This policy covers personal data you give us through this website: the appointment request form, contact details you use to reach us, and the teleconsultation booking service linked from the site. It does not cover the medical records created when you receive care at our hospital. Those records are governed by the consent you give to your care team and by our patient data privacy procedures under the DOH Standard on Patient Healthcare Data Privacy.
We collect only what we need to respond to you.
| Where | What we collect |
| Appointment request form | First name, last name, email, mobile number, specialty, preferred doctor, preferred date and call-back time [confirm against the live form] |
| Email or phone enquiries | Your name, contact details and what you tell us in your message |
| Teleconsultation booking | Collected by our teleconsultation provider when you book through their platform (see section 5) |
| Automatically, when you browse | IP address, browser type, pages visited and time of visit, recorded in server security logs [plus analytics data, if analytics is enabled] |
We do not ask for your medical history, symptoms, insurance details or Emirates ID through this website. Please do not include medical details in website enquiries; share them with your doctor during your visit.
We use your data only for the purpose you gave it to us. We do not sell, rent, or trade it.
| Purpose | Lawful basis |
| Calling you to confirm an appointment request (the request is not a confirmed booking until our team calls you) | Your consent, given when you submit the form, and steps you asked us to take before receiving care |
| Answering your enquiry by phone or email | Your consent |
| Keeping the website secure and detecting misuse | Our legal obligations under ADHICS and our legitimate interest in protecting our systems |
| Sending news or health information | Only with your separate, explicit consent. You can opt out at any time. |
| Meeting legal or regulatory requests | Compliance with UAE law and DOH requirements |
Where we rely on consent, you can withdraw it at any time by contacting us (section 12). Withdrawal does not affect anything we did before you withdrew it.
The specialty or doctor you choose when requesting an appointment can indirectly reveal something about your health, for example, a request for psychiatry or dermatology. We treat these choices as sensitive personal data. We use them only to arrange and confirm your appointment, and only staff involved in scheduling can see them.
Any medical information you share with us is protected by medical confidentiality under UAE Federal Law No. 2 of 2019 and DOH requirements, and is never used for marketing.
We share data only when needed for the purposes above, and only under a written agreement that requires the recipient to protect it.
If you go on to become our patient, your clinical records are shared with insurers, DOH and the Malaffi health information exchange as required for your care. That is covered by our patient privacy procedures, not this website policy.
| Type | What it does | Your choice |
| Strictly necessary | Keeps the site working and secure, including bot protection | Always on |
| Analytics [only if used] | Counts visits and shows which pages are useful | Off unless you accept |
| Embedded video (YouTube) | Plays videos on our pages; YouTube may set its own cookies when you play a video | Off unless you accept |
Links to our Facebook, Instagram, X, LinkedIn and YouTube pages take you to those sites, where their own privacy policies apply. You can change your cookie choices at any time through [the cookie settings link at the bottom of each page], or by clearing cookies in your browser.
Website and form data is stored on servers located in the UAE. Some service providers, such as Microsoft and YouTube, may process data outside the UAE.
When data leaves the UAE, we transfer it only as PDPL allows to countries with adequate data protection, or under contractual safeguards. Health data is kept within the UAE unless an exception under Federal Law No. 2 of 2019 and DOH rules applies.
| Data | Kept for |
| Appointment requests | 1 week after our confirmation call, then deleted. If you become a patient, your details move into your medical record and the patient record retention rules apply. |
| Email enquiries | 1 year after the enquiry is closed |
| Server security logs | 1 month or longer if needed to investigate a security incident |
| Marketing consent records | Until you withdraw consent |
We protect personal data with technical and organizational controls aligned with ADHICS, including encrypted connections (HTTPS), access limited to staff who need it, two-factor authentication for website administration, security monitoring, and written data protection terms with our service providers.
If a personal data breach is likely to put you at risk, we will notify you and the relevant authorities as required by PDPL and DOH rules.
Under PDPL, you have the right to:
To use any of these rights, email our Data Protection Officer (section 12). We may ask you to confirm your identity first. We will respond within [30 days]. Rights over medical records are subject to the retention periods required by DOH and UAE health law.
If you are not satisfied with our response, you can complain to the UAE Data Office or to the Department of Health – Abu Dhabi.
This website is not intended for use by children under 18. A parent or legal guardian should request appointments and make enquiries on a child’s behalf. If we learn that a child has given us personal data without a guardian’s involvement, we will delete it.
For any questions about this policy or your personal data, contact:
Data Protection Officer, Millennium Hospital (Ahalia Medical Group) Email: ciso@Ahaliahospital.com
We review this policy at least once a year and whenever our website or the law changes. The current version is always published on this page.
Last updated: 15.10.2026