%2520(350%2520x%2520150%2520px)%2520(90%2520x%252040%2520px)%2520(4).png%3Falt%3Dmedia%26token%3Dbed5580f-de12-4061-ac20-36c16b313f14&w=384&q=75)
Privacy Policy
xlr8well is committed to protecting your privacy and handling your personal data — especially health data — with the highest care.
Last updated: 24 May 2026 · Version 1.0
Quick Reference
1. Who We Are
xlr8well Ltd ("xlr8well", "we", "us") is an at-home healthcare and wellness platform operating in Dubai, UAE and Tyne and Wear, United Kingdom. We are the data controller responsible for your personal information.
Contact: privacy@xlr8well.life
702 Yes Business Tower, Al Barsha 1, Dubai, UAE
DHA License: 88987544
2. Personal Data We Collect
We collect different types of data depending on how you use our services:
2.1 Account & Identity Data
- Full name, email address, phone number, date of birth
- Emirates ID or passport number (for DHA-required identity verification)
- Billing and delivery address
- Account credentials (stored securely via Firebase Authentication)
2.2 Health & Medical Data (Special Category)
⚠ Article 9 GDPR This is sensitive data and is processed only with your explicit consent.
- Biomarker and blood test results
- Medical history, symptoms, diagnoses you share with us
- Biological age assessments and health scores
- Medication and supplement details
- Physiotherapy and treatment records
- Mental health information you voluntarily provide
2.3 Booking & Transaction Data
- Service bookings, visit schedules, and appointment history
- Payment information (processed by Stripe — we do not store card numbers)
- Order history and invoices
2.4 Technical & Usage Data
- IP address (anonymised where possible), browser type, device type
- Pages visited, time on site, clicks (analytics only with your consent)
- Language and location preferences (stored locally in your browser)
3. How and Why We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Providing healthcare and wellness services | Contract performance · Explicit consent (health data) |
| Booking management and scheduling | Contract performance |
| Sending appointment confirmations and results | Contract performance · Legitimate interest |
| Processing payments | Contract performance |
| Improving our services and platform | Legitimate interest |
| Analytics (usage patterns) | Consent |
| Marketing and retargeting ads | Consent |
| Legal and regulatory compliance (DHA) | Legal obligation |
| Fraud prevention and security | Legitimate interest |
5. Third Parties We Share Data With
We only share data with third parties where necessary:
Database, authentication, and file storage
Legal basis: Data Processing Agreement · Standard Contractual Clauses
Regulatory reporting obligations
Legal basis: Legal obligation
We never sell your data to third parties.
6. How Long We Keep Your Data
7. Your Rights Under GDPR
If you are in the UK or EEA, you have the following rights:
📋 Right to Access
Request a copy of all data we hold about you (Subject Access Request).
✏️ Right to Rectification
Correct inaccurate or incomplete personal data.
🗑️ Right to Erasure
Request deletion of your data ("right to be forgotten"). Some data may be retained for legal reasons.
📦 Right to Portability
Receive your data in a structured, machine-readable format.
🚫 Right to Object
Object to processing based on legitimate interest or for direct marketing.
⏸️ Right to Restrict
Ask us to pause processing while a dispute is resolved.
🔄 Right to Withdraw Consent
Withdraw consent at any time without affecting prior processing.
🏛️ Right to Complain
Lodge a complaint with the ICO (UK) or your local supervisory authority.
Exercise your rights
Submit a request via our Data Subject Rights page or email dpo@xlr8well.life. We will respond within 30 days.
8. Special Category: Health Data
⚠ Important — Sensitive Data
Health and medical data is classified as "special category" data under Article 9 GDPR and is given the highest level of protection.
We process health data exclusively on the basis of your explicit consent. This means:
- You must actively consent before we store any health information about you
- Health data is stored in Firebase (EU data centres) with encryption at rest and in transit
- Only DHA-licensed clinical staff and our authorised engineers can access health records
- Health data is never used for marketing purposes
- You can request deletion at any time (subject to the 10-year DHA retention requirement)
9. Data Security
- All data is transmitted over HTTPS (TLS 1.2+)
- Firebase (our database provider) is ISO 27001 certified and uses AES-256 encryption at rest
- Role-based access controls — staff see only the data relevant to their role
- Passwords are never stored in plain text (Firebase Authentication manages credentials)
- Payment card data is handled exclusively by Stripe (PCI DSS Level 1 compliant)
- We conduct security reviews and access audits regularly
In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours as required by Article 33 GDPR.
10. Children's Privacy
Our services are not directed at children under 16. We do not knowingly collect personal data from minors without explicit parental or guardian consent. If you become aware that a child under 16 has provided us personal data without consent, please contact us immediately at privacy@xlr8well.life.
11. International Data Transfers
We operate in the UAE and UK. Some of our service providers (including Google Firebase) process data outside the EEA. Where this occurs, we ensure adequate safeguards are in place:
- EU Standard Contractual Clauses (SCCs) with all US-based processors
- Adequacy decisions where applicable
- UK IDTA (International Data Transfer Agreement) for UK transfers
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and display a notice on our website. The "last updated" date at the top reflects the most recent revision. Continued use of our services after changes constitutes acceptance of the updated policy.
13. Contact Us
General Privacy Enquiries
privacy@xlr8well.lifeData Protection Officer
dpo@xlr8well.lifeUK Supervisory Authority
Information Commissioner's Office (ICO)Exercise Your Rights
Data Subject Rights Request