Privacy Policy

Who we are

Alpha Health Group is the trading name used by Alpha Health Consultancies and NextHealth Technologies LLC (together "Alpha Health Group", "we", "us"). We provide healthcare consultancy, facility licensing and healthcare professional licensing services in the UAE and the GCC. Both companies act as controllers of the personal data described in this policy.

• Address: 1101, 11th Floor, Damas Tower, Al Maktoum Road, Dubai, United Arab Emirates
• Email: info@alphatsm.com
• Phone: +971 4 272 4064

This policy covers the website alphahmc.com, our inquiry forms and AI project planner, our WhatsApp Business account, our consultancy and licensing services, and the internal tools we use to manage our Google Ads account and Google Business Profile.

Data we collect

Data you give us

• Inquiry and contact forms: your name, email address, phone number, the service you are interested in, your message and, if you choose one, a preferred meeting date and time.
• AI project planner: your answers about your project (for example the type of facility, its location, the services you need and anything you write in your own words) and, if you ask us to contact you, your name, email address and phone number.
• Reviews: your name, email address, position, company, rating and review. If we approve a review, we publish your name, position, company, rating and review text. We never publish your email address.
• Licensing and consultancy clients: the documents and details you send us so we can deliver the service, such as your passport, qualifications, experience certificates, professional licenses, good standing certificate and CV, or, for facility projects, details of the facility and its owners.
• WhatsApp messages: see section 6.

Data collected automatically

• Technical data: your IP address, browser and device type, and the pages you visit. Our server keeps session records with your IP address and browser details.
• Analytics and advertising data: how you use the site and whether you contacted us after clicking an ad, collected by Google tags as described in section 7.

Health information

We do not ask for patient health records, and our website and messaging channels are not designed to receive them. Please do not send us patient health information.

How we use your data, and our legal basis

We do not sell personal data, and we do not use it to make decisions that have legal or similarly significant effects on you by automated means alone.

AI project planner

When you use the planner at alphahmc.com/plan-your-project, we send your project answers, including anything you type in your own words, to Google's Gemini API to generate your plan. We do not send your name, email address or phone number to Gemini.

Google's Gemini API terms allow Google to use content submitted through some service tiers to improve its products, and human reviewers may read it. Do not include personal, patient or confidential information in your answers. The plan is guidance to start a conversation with our team, not a decision about you.

Google user data

Our internal tools connect to Google accounts that Alpha Health Group owns or manages. Access starts only when an authorised member of our team signs in with Google and grants permission. The tools are not offered to the public.

What we access

• Google Ads API (scope https://www.googleapis.com/auth/adwords): account and campaign settings, ad groups, keywords, ads, budgets, search term reports, and performance and conversion statistics. The tools can also create and change campaigns, ads, keywords and budgets in our account.
• Google Business Profile API (scope https://www.googleapis.com/auth/business.manage): our business information, posts, performance statistics, and reviews of our business, including the reviewer's public name and review text. The tools can also post updates and reply to reviews.
• Google account details: the name and email address of the Google account that grants access, so we know which team member connected it.

How we use it

We use this data only to manage, report on and improve our own advertising and business profile: for example to review campaign results, adjust keywords and budgets, and reply to reviews.

How we store and share it

Access tokens and the data we retrieve are kept on systems controlled by Alpha Health Group and are available only to authorised team members. We do not sell Google user data or share it with third parties, except where needed to provide these features, to comply with the law, or as part of a merger or acquisition with notice to you.

Limited Use

Alpha Health Group's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertisements, to build profiles for advertising, or to determine creditworthiness, and we do not use it to train generalised AI or machine learning models. Our team does not read this data unless you have agreed, it is needed for security or to comply with the law, or it is aggregated and anonymised for internal operations.

Revoking access and deletion

A Google account holder can remove our access at any time at myaccount.google.com/permissions. When access is removed, we delete the stored access tokens. To ask us to delete Google user data we hold, follow section 13.

WhatsApp messaging

We use the WhatsApp Business Platform (Cloud API) from Meta to talk to clients and people who contact us. The "Message us on WhatsApp" buttons on our site open a chat with a prefilled message naming the page you were on. Nothing is sent until you press send.

What we receive

• Your WhatsApp phone number and profile name
• The messages, documents and images you send us, and our replies
• Message details such as the time sent and whether a message was delivered and read

How we use it

We use your messages to answer your inquiry, deliver the service you asked for, and send you updates about your application or appointment. We send you information about our services only if you have agreed to receive it.

Messages we start

We only start a WhatsApp conversation with you if you have contacted us or given us your number and agreed to hear from us on WhatsApp. You can ask us to stop at any time by replying "STOP" or by emailing info@alphatsm.com, and we will stop messaging you.

Meta's role

Meta processes these messages for us as our service provider under the WhatsApp Business terms. Your use of WhatsApp itself is covered by WhatsApp's privacy policy. To delete the data we hold from WhatsApp conversations, follow section 13.

Cookies and analytics

We use Google Tag Manager, Google Analytics and Google Ads tags to measure how the site is used and which ads lead to inquiries. These tags follow Google Consent Mode:

• For visitors in the EU, EEA, UK and Switzerland, analytics and advertising storage stays off until you click Accept.
• For visitors elsewhere, it is on until you click Reject.

You can change your choice at any time through the cookie banner or by clearing your browser storage. We remember your choice in your browser for 30 days. Our site also uses strictly necessary cookies, such as a session cookie and a form security cookie, which the site needs to work. Details are in our cookie policy.

Our forms are protected by Google reCAPTCHA, which checks your device and behaviour to block spam. Google's Privacy Policy and Terms of Service apply.

Who we share your data with

Service providers

• Microsoft Azure: hosts the website and its database in the UAE North (Dubai) region
• Google: Tag Manager, Analytics, Ads, reCAPTCHA, Gemini API and web fonts
• Meta: the WhatsApp Business Platform
• Resend: delivers the emails our website sends
• Our email hosting provider: hosts our team's mailboxes
• Content delivery networks (cdnjs, jsDelivr and the jQuery CDN): serve the site's scripts and styles and receive your IP address when your browser loads them

Authorities and verification bodies, on your instructions

To deliver a licensing or facility service, we submit your documents and details to the bodies the service requires, such as the Dubai Health Authority (DHA), the Department of Health Abu Dhabi (DOH), the Ministry of Health and Prevention (MOHAP), the Sharjah Health Authority (SHA), other GCC health regulators, the DataFlow Group for primary source verification, and exam providers such as Prometric and Pearson VUE. Each of these bodies handles your data under its own privacy terms.

Others

Our professional advisers under confidentiality duties; authorities when the law requires it; and a buyer or successor if our business is sold or merged, in which case we will tell you first.

International transfers

Our website and its database are hosted in the UAE. Google, Meta and Resend may process data in other countries, including the United States. We rely on the conditions for cross-border transfers in the PDPL and, for data covered by the GDPR, on these providers' data processing terms, including standard contractual clauses where they apply.

How long we keep your data

• Inquiries, planner submissions and WhatsApp conversations: 2 years from our last contact with you
• Client and licensing files: 7 years after the engagement ends, to meet legal and accounting requirements
• Reviews: while the review is published, or until you ask us to remove it
• Google user data: while we need it to manage our advertising and business profile; tokens are deleted when access is revoked
• Analytics data: up to 14 months

After these periods, we delete the data or make it anonymous.

Security

• All traffic to alphahmc.com is encrypted with HTTPS.
• The website database runs on Microsoft Azure in the UAE, on disks that are encrypted at rest.
• Our team's access to inquiries and client data is limited by role and permission.
• Our forms use spam filtering and rate limits.

No system is completely secure. If you think your data with us has been put at risk, email info@alphatsm.com.

Your rights

Under the PDPL, and the GDPR where it applies, you can ask us to:

• give you a copy of the personal data we hold about you
• correct data that is wrong or incomplete
• delete your data
• restrict how we use it, or object to our use of it, including for marketing
• give you your data in a format you can pass to another organisation
• stop processing based on your consent, by withdrawing it at any time

Email info@alphatsm.com. We may ask you to confirm your identity, and we reply within 30 days. There is no charge.

If you are not satisfied with our reply, you can complain to the UAE Data Office or, if you are in the EU, EEA or UK, to the data protection authority where you live.

How to delete your data

1. Email info@alphatsm.com with the subject "Data deletion request", or send "Delete my data" to us on WhatsApp.
2. Include your name and the email address or phone number you used with us.
3. We confirm your request, delete your data from our website database, inbox and WhatsApp records, and tell you when it is done, within 30 days.

We keep only what the law requires us to keep, such as invoices, and we tell you what we kept and why. To remove our access to a Google account, see section 5.

Children

Our services are for healthcare professionals and organisations. We do not knowingly collect data from anyone under 18, and we delete it if we find we have.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change affects how we use data you have already given us, we will tell you before it applies.