1 Scope
This notice explains how UAE Congenital Heart Association — NABDA collects, uses and protects personal information when people contact the Association through NABDA Communications and its WhatsApp channel. It covers information received or created to manage communications and follow-up. WhatsApp is not used to diagnose, prescribe treatment or approve assistance decisions.
2 Controller and contact
UAE Congenital Heart Association — NABDA determines the purposes for which information is processed in the communications system. Contact office@uaecha.ae or 0503753011 for privacy enquiries and data requests.
3 Information we may process
- Phone number, name, visible profile name and profile image where available.
- Message content, timestamps, identifiers and available sent, delivered and read statuses.
- Conversation status, classification, assignment and operational follow-up notes.
- Staff sign-in, permissions, changes, audit events and technical error information needed for security and operation.
- Attachment metadata and information the sender chooses to include.
Please do not send identity documents, bank account information or medical reports in an initial message unless an authorised staff member directs you to an approved and appropriate channel.
4 Sources
We receive information from you or your representative, from WhatsApp and Meta when channel events are delivered, and from authorised staff who classify, assign or document follow-up. Historic phone chats and the phone address book are not imported automatically unless a separate scope is approved.
5 Purposes
- Receive and answer enquiries and organise follow-up.
- Assign conversations to authorised staff and document their status and related actions.
- Send service updates, reminders or materials the recipient agreed to receive, subject to law and channel rules.
- Protect accounts and systems, verify permissions, prevent abuse and fraud, and investigate incidents.
- Meet legal and regulatory duties, preserve evidence and protect rights.
- Prepare aggregated operational statistics after minimising or de-identifying information where practicable.
6 Legal grounds and minimisation
We process information on the basis of consent where required, steps taken to respond to your request or provide the requested service, legal obligations, or another ground permitted by applicable law. We collect only what is needed and do not use broad consent to cover an unexpected new purpose.
If a message becomes part of an assistance, donation, complaint, medical, financial or legal record, the necessary copy is placed in the appropriate record and the controls for that record apply.
7 Children and sensitive information
Association services may concern children or health matters. We engage a parent, guardian or other representative where required and verify authority proportionately. Sending a medical report is not consent to use it for publicity, research or AI training.
If sensitive information is received unexpectedly, access is restricted and the Association decides whether the necessary part should be moved to an approved record or deleted under applicable law and policy.
8 Sharing and service providers
Internal access is limited to authorised people who need the information for their work. WhatsApp and Meta may process information to deliver and manage the channel, and Microsoft provides cloud hosting and identity services. The Association does not sell personal information.
We may disclose the minimum necessary information to a competent authority, adviser or service provider where there is an appropriate basis, purpose and safeguard. Medical and financial information is subject to additional need and authority review.
9 Processing outside the UAE
Service providers may process service, support or delivery information outside the UAE under their infrastructure, contracts and privacy notices. The Association reviews transfer grounds and safeguards where legal requirements apply.
10 Security
The Association uses role-based access, individual staff accounts, audit records, encrypted connections and protected technical secrets. No control provides absolute security; incidents are recorded, contained and notified where applicable law requires.
11 Retention and backups
We retain information for as long as it is needed for the purpose for which it was collected, taking account of legal duties, third-party rights and any active hold or dispute. Detailed periods are set in the approved retention schedule for the relevant processing. A proposed period is not treated as effective until it is approved.
Deleted information may remain in rotating recovery backups until the backup cycle expires or the data is overwritten. Recovery backups are not used for ordinary operations. Before service is made available after a backup restore, documented deletion and suppression requests must be reapplied and verified.
12 Your rights and requests
Depending on applicable law, you may request access, correction, deletion, restriction, objection, cessation of communications or data portability. We verify identity using the least information necessary, assess lawful exceptions and the rights of others, and explain the outcome and the basis for retaining any part.
Email office@uaecha.ae or call 0503753011. Do not attach an identity document or medical report to the first request; the Association will propose a proportionate verification method if needed.
13 Stop communications and limits of deletion
You may stop non-essential communications by sending “STOP” or «إيقاف» through the same channel, or by contacting us by email or telephone. We may retain a limited suppression record, such as the number and request date, to prevent contact contrary to your choice.
Deleting the Association’s copy does not automatically remove copies on sender or recipient devices, or information Meta, WhatsApp or Microsoft processes for independent purposes or legal duties. You may need to use account tools or contact the provider about provider-held data.
14 Changes
We update this notice when there is a material change to information types, purposes, service providers or retention controls, and publish the last-updated date with the current version.