Get in Touch with Tongren Tang Gulf
A Covenant of Trust
Privacy Policy
Your trust is foundational to our care. This policy describes — clearly and honestly — what information we gather, why, and how we protect it.
At Tong Ren Tang Gulf, we regard the protection of your personal and health information with the same care and precision we bring to your treatment. The medicine we practise is older than most modern nations. The responsibility of guarding what you share with us is no less ancient.
This Privacy Policy describes how Tong Ren Tang Gulf (“we,” “us,” or “our”) — operating clinics at Dubai Healthcare City and Jumeirah, Dubai, United Arab Emirates — collects, uses, stores, shares, and protects personal and health information about our patients, website visitors, corporate partners, and job applicants.
We process personal data in accordance with applicable laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”), regulations issued by the Dubai Health Authority and the Dubai Healthcare City Authority, and — where relevant — the principles of internationally recognised data-protection standards such as the EU General Data Protection Regulation.
This policy applies to our websites, our physical clinic premises, our telephone and messaging channels, our corporate wellness services, and any other point of contact through which we collect your information. By using our services, you acknowledge that you have read and understood this policy.
Depending on the nature of your interaction with us, we may collect the following categories of information:
Identifying & Contact
Full name, date of birth, gender, nationality, Emirates ID or passport number. Residential address, telephone, email, emergency contact, and corporate affiliation.
Health & Medical
Medical history, allergies, medications, symptoms, and clinical observations (tongue/pulse). Treatment plans, session notes, imaging, lab results, and insurance details.
Payment & Financial
Invoicing records, payment history, and card transactions (processed by PCI-DSS compliant third parties — we do not store full card numbers).
Technical & Website
IP address, browser type, device identifiers, pages viewed, session length, referring sites, and cookie identifiers.
Marketing & Comms
Communication preferences, marketing consent, survey responses, event attendance, and feedback.
Health information constitutes “sensitive personal data” under the UAE PDPL. We process such data only where legally permitted, typically with your explicit consent, or where processing is necessary for the provision of medical care.
We collect information through the following channels:
Directly from you
When you register as a patient, complete a consultation form, speak with our physicians, book an appointment, or contact us.
Automatically
Through cookies, analytics tools, and our clinic management systems when you visit our website or attend our clinics.
From third parties
Including referring physicians, insurance providers, corporate wellness partners, and emergency contacts.
Public/Official sources
Where required for identity verification or regulatory compliance.
We use your information for specific, lawful purposes, including:
Medical Care & Records
Diagnosis, treatment, prescription of herbal formulas, and follow-up. Maintaining medical records as required by UAE healthcare regulations.
Administration
Appointment scheduling, reminders, and cancellations. Billing, payment processing, and insurance claims management.
Corporate Wellness
Delivering services to partner organisations and reporting aggregated, anonymised data to employers.
Compliance & Quality
Responding to lawful requests from authorities, maintaining licences, fulfilling statutory obligations, and analysing de-identified service utilisation.
Under the UAE PDPL, we rely on one or more of the following legal grounds to process your personal data:
Your consent
Particularly for marketing communications and the processing of sensitive health information beyond what is strictly necessary for treatment.
Performance of a contract
To provide the medical services you have requested.
Legal obligation
To maintain records and comply with UAE healthcare laws and regulatory requirements.
Vital & Legitimate interests
To protect your life in an emergency, or for administrative and security purposes where such interests do not override your rights.
Where we rely on your consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and will not affect our ability to retain data we are legally required to keep.
We do not sell your personal data. We share it only in the following limited circumstances:
Healthcare Providers
Treating physicians and providers with your knowledge and consent, where coordinated care requires it.
Insurance & Authorities
To process claims and verify coverage. Or sharing with DHA, DHCC, and MOHAP where required by law.
Corporate Partners
For employer-sponsored care, we share only aggregated, anonymised data. Individual health details are never disclosed without explicit consent.
Service Processors
IT systems, payment processors, and advisers bound by strict confidentiality and data-protection obligations.
We retain your information only for as long as necessary, or as required by applicable law. Medical records are typically retained for a minimum of 25 years from the last date of treatment. Financial records are retained for 5 years.
We implement appropriate technical and organisational measures, including:
Technical Safeguards
Encryption of data in transit and at rest. Role-based access controls limiting who can view patient records.
Physical Safeguards
Secure physical storage of any paper-based records in access-controlled premises.
Procedural Safeguards
Ongoing confidentiality training for staff, regular system reviews, and incident-response procedures.
Subject to the limitations of applicable law, you have the following rights in relation to your personal data:
Access & Rectification
To request confirmation of data we hold, obtain a copy, and request correction of inaccurate information.
Erasure & Restriction
To request deletion or restriction of your data, subject to our legal retention obligations for medical records.
Objection & Portability
To object to direct marketing or processing based on legitimate interests, and to receive a structured copy of your data.
Consent & Complaint
To withdraw consent at any time, and to lodge a complaint with the UAE Data Office or relevant supervisory authority.
Cookies & Tracking
Our website uses cookies. Essential Cookies are required for basic functioning. Analytics Cookies help us understand site usage via anonymised data. Marketing Cookies are used only with your consent.
International Transfers
Your information is primarily processed in the UAE. Where transferred abroad (e.g., cloud providers), we ensure appropriate safeguards compliant with the UAE PDPL are in place.
Children’s Privacy & Updates
For paediatric patients, registration and consent must be provided by a guardian. We do not direct marketing to children. We may update this policy periodically; material changes will be notified via our website or email.
If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have any concerns about how we handle your information, please contact us.
Regulatory Authority: You also have the right to lodge a complaint with the UAE Data Office or other competent supervisory authority, should you believe we have not resolved your concerns satisfactorily.
