Privacy policy

Last updated 12 November 2026. If we change this policy in a way that matters, we say so here first.

1. Who we are

Windsor Medical Center is an outpatient mental health clinic licensed by the Dubai Health Authority, at 771 Villa, Al Wasl Road, Al Safa, Jumeriah, Dubai, United Arab Emirates. We are responsible for the information you give us through this website, through our Facebook and Instagram forms, and when you call or message us.

We handle your information under the laws of the United Arab Emirates, including Federal Law No. 2 of 2019 on the use of information and communications technology in health fields, Federal Decree-Law No. 45 of 2021 on the protection of personal data where it applies, and the Dubai Health Authority's requirements for health information.

2. What we collect

When you send us a request on this website

Our booking, insurance check and Itamen check-in forms ask for your name and phone number, and optionally your email address. Depending on the form, you may also give a preferred clinician, a preferred time, your insurance company and member ID, and a message. We keep exactly what you send.

When you fill in one of our forms on Facebook or Instagram

Some of our ads open a form inside Facebook or Instagram. Meta collects what you enter there, usually your name, phone number and email address and the answers to that form's questions, and passes it to us so we can contact you. With it we receive which of our forms, ads and campaigns it came from. Meta also holds that information under its own privacy policy.

How you found us

If you reach this website through a link that carries campaign tags, for example from one of our ads, and then send us a request, we record with that request which campaign brought you, the first page you opened and the website that sent you. If the link came from an ad platform, we note which one, but we never keep the platform's click identifier, which could be used to link your request back to your account there. Until you send a request, these notes stay in your own browser tab and are deleted when you close it. If your browser asks websites not to track you, we record nothing.

When you browse

We count page views, arrivals, the websites that sent people here and whether they used a phone, tablet or computer. We do this ourselves, in our own database, without cookies and without any identifier, and we keep totals only, never a record of an individual visit. Your internet address is used for a few seconds to protect the counting from abuse and is never stored.

When you become our patient

Your clinical records are created and kept by your care team in our clinical systems, not on this website. They are covered by medical confidentiality as well as by this policy.

What we ask you not to send

Please do not describe symptoms, diagnoses or medication in a web or social media form. We will talk about your needs in confidence, by phone or in person.

3. How we use it

• To reply to your request, arrange an appointment and match you with a suitable clinician.
• To check your insurance cover with your insurer, when you ask us to.
• To provide, record and follow up your care if you become our patient.
• To see which pages and campaigns help people reach us, using totals and campaign tags, never a profile of you.
• To meet our legal and regulatory obligations, including the Dubai Health Authority's.

We do not sell your information. We do not use it to build advertising profiles. We do not send it back to Meta, Google or any other advertising platform, and this website has no advertising pixels or tracking tags. No decision about your care is made by a computer.

4. Who can see it

• Our team, only as far as their work needs: reception, the clinician you see and the clinic's management. Access is set by role, so for example the person who follows up Facebook and Instagram enquiries sees only those.
• Your insurer or its claims administrator, when you ask us to check your cover or when we claim for your care.
• Companies that run our systems for us: Microsoft, which hosts this website and its database, and our email provider. They process your information only on our instructions.
• WhatsApp, if you message us there or ask us to contact you there. WhatsApp carries those messages under its own terms.
• Authorities, such as the Dubai Health Authority or a court, when the law requires it.

Nobody else, unless you agree.

5. Where it is kept

This website, its database and the files it stores are hosted by Microsoft Azure in its UAE North region, inside the United Arab Emirates, as UAE law requires for health information.

To show this website, your browser also loads fonts from Google and a small script library from a public content network. Like any website you visit, those services see your internet address while delivering the files; we send them nothing else. Clinician videos are played from YouTube or Vimeo when you choose to play one, and their own policies apply to what they collect.

6. How long we keep it

• Requests, from the website or from Facebook and Instagram: for as long as we need them to follow up your enquiry and to keep an accurate record of how patients reach us. You can ask us to delete a request at any time; see section 9.
• Clinical records: for at least 25 years after your last visit, as UAE law requires.
• Visit counts: kept as totals, which say nothing about any person.

7. Cookies and this website

On the public pages this website sets one cookie: a security cookie that protects our forms against forgery. It holds nothing about you and the forms cannot work without it. Staff who sign in to the clinic's own system receive a sign-in cookie. We use no advertising cookies and no third-party analytics.

8. Your rights

You can ask us:

• for a copy of the information we hold about you;
• to correct anything that is wrong or incomplete;
• to delete it, except what the law requires us to keep, such as clinical records;
• to stop contacting you;
• how your information has been used and who it has been shared with.

To protect you, we may ask you to confirm who you are before we act. We reply within 30 days. If you are not satisfied with our answer, you can complain to the Dubai Health Authority.

9. How to have your information deleted

To have us delete a request you sent through this website or through one of our Facebook or Instagram forms:

1. Email customercare@windsorclinics.ae with the subject Delete my information, or call +971 50 542 4525.
2. Tell us the name and the phone number or email address you used, so we can find it.

We delete the request, its answers and the record of how you found us within 30 days, and confirm when it is done. If you are or have been our patient, your clinical records are kept for as long as the law requires.

What you entered in a Facebook or Instagram form is also held by Meta. To remove it there, use the privacy settings of your Facebook or Instagram account.

10. Children and young people

We care for children and adolescents. A request about someone under 18 should be made by their parent or legal guardian. If you are under 18 and want help, please ask a parent, a guardian or another adult you trust to contact us with you. If you are in crisis, see our urgent help page.

11. How we protect it

• Every page and form is served over an encrypted connection.
• Staff see only what their role needs. Staff who look after patient requests sign in with a password and, for most roles, a code from an authenticator app, and every sign-in is recorded.
• Messages from Meta about new enquiries are checked to be genuinely from Meta before they are accepted.
• We will never ask you for a password, or for card or bank details, by WhatsApp, email or social media.

12. Contact us

For any question about your information, or to use any of your rights:

• Email: customercare@windsorclinics.ae
• Phone: +971 50 542 4525
• Post or in person: Windsor Medical Center, 771 Villa, Al Wasl Road, Al Safa, Jumeriah, Dubai, United Arab Emirates