This policy explains how MACCAR HEALTHCARE COMPLIANCE - FZCO ("Maccar Medical", "we", "us") collects, uses, shares and protects personal data when you visit our website, contact us, request a quotation, place an order, book a service visit or receive our e-mails.
We process personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). For customers in the United Kingdom, the UK General Data Protection Regulation (the "UK GDPR") and the Data Protection Act 2018 also apply.
Who we are and how to contact us
The controller of your personal data is MACCAR HEALTHCARE COMPLIANCE - FZCO, Premises No. 78292-001, IFZA Business Park, DDP, Dubai Silicon Oasis, Dubai, United Arab Emirates. You can reach us at info@maccar.uk or on +971 50 318 7422.
We work from the following offices:
- Dubai — head office: Premises No. 78292-001, IFZA Business Park, DDP, Dubai Silicon Oasis, Dubai, United Arab Emirates
- London: 140 Goswell Road, London, United Kingdom
For any question about this policy or your personal data, write to our data protection contact at privacy@maccar.uk.
Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact details | Name, job title, organisation, e-mail address, phone number, delivery and billing addresses | You |
| Account data | Sign-in e-mail, password (stored only as a one-way hash), preferences, saved addresses, order and quotation history | You, our systems |
| Business and professional verification | Trade licence number, VAT Tax Registration Number (TRN), healthcare facility or professional licence number and licensing authority (for example DHA, DoH or MOHAP), copies of the licences you upload | You |
| Orders and payments | Products, quantities, prices, VAT, delivery method, payment method, payment status and the transaction reference returned by the payment provider. We do not receive or store full card numbers. | You, payment providers |
| Prescriptions | The prescription you upload for a prescription-only product. We treat it as sensitive data. | You |
| Communications and service | Messages, quotation requests, service requests, equipment serial numbers, product reviews | You |
| Technical data | IP address, browser and device type, pages viewed and cookie identifiers — see our cookie policy | Your device |
| Marketing preferences | Newsletter subscription, the date you gave consent, opt-outs | You |
Please do not send patient-identifiable information through our forms or e-mail. Prescriptions should be uploaded only through the secure upload at checkout.
Why we use personal data and on what basis
Under the PDPL we rely on your consent, or on one of the cases in Article 4 of the PDPL in which data may be processed without consent — for example when processing is necessary to perform a contract with you, to comply with another law, or to establish or defend legal claims. For UK customers, the corresponding legal bases of the UK GDPR are shown below.
| Purpose | UAE (PDPL) | UK (UK GDPR) |
|---|---|---|
| Preparing quotations, processing orders, delivery, installation, training and after-sales service | Performance of a contract or steps you asked us to take before one | Contract |
| Checking business and professional status before supplying professional-use devices | Compliance with laws on medical products; performance of the contract | Legal obligation; legitimate interests in supplying medical devices responsibly |
| Reviewing prescriptions for prescription-only items | Your consent given when you upload the prescription; compliance with applicable law | Explicit consent; legal obligation |
| Issuing tax invoices and credit notes, accounting and VAT records | Compliance with UAE tax legislation | Legal obligation |
| Answering enquiries and customer service | Performance of a contract or steps before one; consent | Contract; legitimate interests |
| Passing on manufacturer safety notices and recalls for products you bought | Compliance with laws on medical products; protection of your interests | Legal obligation; legitimate interests |
| Security, fraud prevention and protection of our systems | Compliance with law; establishing or defending legal claims | Legitimate interests; legal obligation |
| Newsletters and marketing e-mails | Consent, confirmed through the link we e-mail you (unless you subscribe while signed in to an account with a confirmed address) | Consent |
| One reminder about a basket you left after submitting the checkout form | Following up an order you started; you can object with the link in the reminder, and it is not sent once you have opted out of marketing e-mails | Legitimate interests |
| Analytics and advertising cookies; embedded videos (YouTube, Vimeo), which load only when you press play or allow marketing cookies | Consent | Consent |
Where we rely on consent you may withdraw it at any time. Withdrawal does not affect processing that took place before it.
Cookies
We use strictly necessary cookies to run the website and, only with your consent, preference, analytics and marketing cookies. Our cookie policy lists every cookie, its purpose and duration, and explains how to change your choice.
Who we share personal data with
We share personal data only where needed for the purposes above:
- Payment providers that process card, instalment or other online payments you choose at checkout.
- Couriers and logistics partners that deliver your order (name, delivery address and phone number).
- Manufacturers and their authorised service partners where needed for warranty claims, installation records, field safety notices or recalls.
- Service providers acting on our instructions, such as website hosting, e-mail delivery, IT support and — with your consent — analytics and advertising providers.
- Professional advisers such as auditors and lawyers, under confidentiality obligations.
- Authorities where the law requires it, for example the Federal Tax Authority, health regulators, courts or the police.
- A buyer or successor of our business, if all or part of it is sold or reorganised, under equivalent protection.
We do not sell personal data.
International transfers
We operate from the UAE and the United Kingdom, and some of our service providers process data in other countries. When personal data is transferred outside the UAE we do so in accordance with Articles 22 and 23 of the PDPL — to countries that provide an adequate level of protection, or with appropriate safeguards such as contractual commitments, or with your consent where required. Personal data of UK customers transferred outside the UK is protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.
How long we keep personal data
| Data | Retention |
|---|---|
| Orders, tax invoices, credit notes and accounting records | At least five years after the end of the tax period to which they relate, as required by UAE tax legislation, and longer while an audit or dispute is open |
| Customer account | While the account is open. When you delete your account we anonymise your personal details and keep only the records the law requires |
| Quotations that did not lead to an order | Two years after our last contact |
| Service and installation records | For the service life of the equipment, where needed for warranty, maintenance and safety notices |
| Prescriptions | Five years after the order is closed (delivered, cancelled or returned), or longer where the rules for prescription-only items require it, with access restricted to authorised staff |
| Business verification documents | While the business account is active and up to twelve months afterwards |
| Contact form messages | Three years after the enquiry is closed |
| Newsletter subscription | Until you unsubscribe; we keep a record of the opt-out so that we can respect it |
| Cookie consent records | Two years from the date of your choice |
| Record of the e-mails we sent you, and the log of actions our staff take on records | Two years |
| IP addresses and browser details stored with orders, messages, quotation and service requests and reviews | Twelve months |
| Security and server logs | Up to 90 days, unless needed to investigate an incident |
How we protect personal data
- All pages are served over an encrypted (HTTPS) connection.
- Passwords are stored only as one-way hashes. Licences, prescriptions and payment proofs are kept in private storage that is not accessible from the internet and are opened only by authorised staff.
- Access to customer data is limited by staff role, and administrative actions are logged.
- Card payments are processed by payment providers; we never see your full card number.
- Forms and sign-in are protected against automated abuse.
If a personal data breach occurs that is likely to affect your rights, we will notify the UAE Data Office and, where required, you without undue delay. For UK customers we will notify the Information Commissioner's Office within 72 hours where the UK GDPR requires it.
Your rights
Under the PDPL you have the right to:
- obtain information about how we process your personal data and receive a copy of it;
- receive your personal data in a structured, machine-readable format and have it transferred (data portability);
- have inaccurate data corrected and have data erased when it is no longer needed;
- restrict processing in the cases set out in the law;
- object to and stop processing, including direct marketing at any time;
- object to decisions based solely on automated processing that have legal or similarly significant effects;
- withdraw your consent at any time.
Customers in the United Kingdom have the equivalent rights under the UK GDPR: access, rectification, erasure, restriction, data portability, objection, and rights related to automated decision-making.
To exercise a right, e-mail privacy@maccar.uk or use your account: you can update your details, change your e-mail preferences or delete your account at any time. We may ask you to confirm your identity. We reply within one month, or within the period the applicable law allows when a request is complex.
If you are not satisfied with our answer, you can complain to the UAE Data Office. Customers in the United Kingdom can complain to the Information Commissioner's Office (ico.org.uk).
Children
Our website and products are intended for adults, healthcare professionals and organisations. We do not knowingly collect personal data from children under 18.
Changes to this policy
We review this policy regularly. The date at the top shows when it was last updated. If we make significant changes, we will tell you by e-mail or with a notice on the website.