How This Website
Handles Your Information
Camali Clinic’s website exists to help you reach the clinic, not to learn about you. This notice describes exactly what the forms on it collect, what they are built to refuse, how long anything is kept and how to have it removed.
What this notice covers
This notice covers camaliclinic.com and the forms on it: the appointment request form, the request panel on each clinician’s profile, the enquiry forms on the workplace, school, training and assessment pages, the careers form, and the registration form on event pages such as the DIB Fair page.
It does not cover your clinical record. Once you become a patient, everything the clinic records about your care is held in the clinic’s own regulated systems under Dubai Health Authority rules, and is governed by the consent you give at reception rather than by this page. The website has no access to those systems and never has.
Ask us anything about this notice at queries@camaliclinic.com or on +971 (4) 276 6064.
What the forms collect
An appointment request
First name, last name, email address, dialling code and phone number, the service you picked from the list, and, if you asked through a clinician’s card, that clinician’s name. Nothing else. The form has no free-text box, and the endpoint behind it discards one if anything posts a message anyway.
An organisation or assessment enquiry
The subject of the enquiry, your name, your organisation and role where you give them, an email address, a phone number, a group size or an age band, when you would like the work to happen, and a short description of what you need. The description field is capped, and the form says above it what not to put in it.
A careers enquiry
Your name, email address and phone number, the area of work you are interested in, your years of experience, and a short note. No CV and no documents: the form does not accept them.
An event registration
At an event the clinic attends, such as a fair: your name, mobile number and email address, your company if you give it, what you are interested in from a fixed list, how you would like to be contacted, and whether you arrived by scanning the event’s QR code. There is no free-text box.
Which page you asked from
Each request records the page it came from, so the right team answers it. That is a page address, not a browsing history: nothing follows you between pages, and no record is built of what you read.
Every form also carries one hidden field that a person never sees and cannot focus. It exists so that automated submissions can be identified and dropped. If you are filling the form yourself, it stays empty and nothing is recorded from it.
What we refuse to collect
UAE law requires patient health information to stay inside the country. Rather than promise to handle such information carefully, this website is built so it cannot receive it in the first place. The appointment form has no message box at all, and the enquiry forms warn against pasting records and cap the one description field far below the length of any real document.
None of the following is ever asked for on this website:
- A description of symptoms, a diagnosis, or anything about a person’s health
- A medical record, a discharge summary, a therapy note or a school report
- A date of birth, an Emirates ID number, a passport number or an insurance number
- Any payment or card detail. The website takes no payments
If you have already sent something sensitive
Call the clinic on +971 (4) 276 6064 and say so. We will remove it rather than wait for the automatic deletion below. Details of your situation belong on the phone or in the room, where they are held in the clinic’s own systems.
How long it is kept
A request sent through this website is a note asking the front desk to call you back. It is not a record, and it is not kept like one. The database deletes it on a schedule that runs every night inside the database itself, so it does not depend on anybody remembering.
Appointment requests: 30 days
Long enough for the front desk to reach you and file whatever matters in the clinic’s own systems, and short enough that a call list never becomes an archive.
Family and assessment enquiries: 30 days
The same rule, for the same reason: a parent asking which assessment pathway fits is starting a conversation, not opening a file.
Event registrations: 90 days
Long enough for the team who met you to follow up after the event, and short enough that a list of visitors never becomes a mailing list.
Careers enquiries: 180 days
A hiring conversation can run for a couple of months, so thirty days would delete a candidate mid-process; a year would keep personal details about one person far longer than any process needs.
Organisation enquiries: 12 months
A proposal for a workplace or a school is a commercial conversation that runs across a term or a budget year, and it holds no patient information at all.
After its date the row is deleted outright. There is no archive copy and no export kept elsewhere.
Who can read it
Requests are readable only by signed-in Camali Clinic staff, through the clinic’s own console. Each member of staff is given the parts of the console their work needs, and sees only those: appointment requests for the front desk, organisation and family enquiries for the team that answers them, careers enquiries for HR, event registrations for the event team. The small number of console administrators, who manage that access, can see every part. The database itself enforces who sees what, not just the screens. It lets staff read a request, record how the call went and mark that someone has opened it, and nothing more. They cannot alter the timestamp the deletion schedule reads, so no request can be quietly kept past its date.
A copy of each request is emailed to the clinic address that answers it, so the team sees it without waiting for somebody to open the console. These emails are sent through the clinic’s own Microsoft 365 email, not through a mailing service, from the clinic’s general enquiries mailbox — which keeps its own copy of what it sent, as any mailbox does. So the people who look after that mailbox can also see the emailed copy of a request, whichever team it went to. Nothing is sold, shared for advertising, or passed to anyone outside the clinic.
You also receive a short email confirming that your request arrived. It repeats nothing you wrote apart from your first name: not the service you chose, and not your message. So if an address is mistyped, whoever receives it learns only that someone with that first name contacted Camali Clinic. It is a one-off confirmation, not a subscription.
So that the team can tell whether those two emails went out, the website keeps a short record of each one beside your request: the address it went to, its subject line and whether Microsoft accepted it. Not the email itself. The record is deleted together with your request, on the same date.
The website’s database and hosting run on established infrastructure providers acting on the clinic’s instructions. Because that infrastructure is not guaranteed to sit inside the UAE, the site is deliberately built so that nothing which UAE law requires to stay in the country is ever sent to it. See what we refuse to collect.
Cookies and tracking
This website uses Google Analytics to count visits and see which pages people find useful. It records the pages you open, roughly how long you stay, how you arrived — a search, a link, or typing the address — and your device and browser type. It also counts a handful of actions: pressing the WhatsApp, phone or email link, opening a clinician’s profile, using the search, and starting or sending one of the forms. What it counts is the action, where on the page it happened and, for a profile, whose it was — never anything you type, and never the service you choose. It does not know who you are, and it is never linked to any appointment request, enquiry or clinical record.
Google derives an approximate location from your IP address — city, region and country, no closer than that. Google states that it does not tie a raw IP address to a user identifier and discards it after that lookup. Your IP address is not something the clinic can see or retrieve; the reports we read show totals, not people.
Analytics sets two cookies in your browser to tell a returning visit from a new one. They hold a random identifier and nothing else — no name, no email address, nothing about your health. You can refuse them by using your browser’s do-not-track or cookie settings, or by installing Google’s own Analytics opt-out add-on. Nothing on this site stops working if you do.
On a few pages written for organisations and professionals rather than for patients — Workplace and its two programme pages, School and School Services, Webinars, Specialist Training, Careers, Our People, Featured and The Camali Story — we also use Microsoft Clarity. It shows how those pages are used: where people click, how far they scroll, and a replay of how a visit to the page went, so we can see where a page is confusing. Clarity is never loaded on a page about care — the home page, our services, clinicians, guides, the FAQ, insurance, contact or booking — so it never sees what brings anybody to the clinic.
On the pages where it runs, everything in the forms, the search box and the menu is hidden in your browser before anything is sent, so none of it reaches Microsoft, and following a link to one of the pages about care stops Clarity before it records the click. Clarity is set to store nothing in your browser here: no cookies, and nothing that joins one page of a visit to the next. It does not start at all if your browser sends a Do Not Track or Global Privacy Control signal, and you can also block scripts from clarity.ms. Nothing on this site stops working if you do.
Clarity is Microsoft’s service, and Microsoft receives what it collects on those pages, including personal data such as your IP address and details of your device and browser. Microsoft collects this data to provide Clarity and, under its terms, also to provide Microsoft Advertising; how Microsoft uses it is set out in the Microsoft Privacy Statement. Microsoft stores Clarity data in the United States and deletes recordings after 30 days.
We have deliberately not turned on Google’s advertising and demographic features, and Clarity is connected to no advertising account, with its advertising storage refused. There is no remarketing, no advertising pixel, no social-network tag, and we build no audience list from your visit. A visit to a mental health clinic’s website is not something to follow anybody around the internet with.
One other cookie exists: the sign-in session for Camali Clinic staff using the clinic’s console. If you are not a member of staff signing in, your browser is never given it. The public pages check only whether it is there, so that the clinic’s own visits are left out of Clarity.
Pages here may link out to other websites: an insurer, a professional body, a partner clinic. Once you follow such a link you are on their site and under their privacy terms, not ours.
Your choices
You can ask what the website holds about you, ask for it to be corrected, or ask for it to be deleted before its date. Write to queries@camaliclinic.com or call +971 (4) 276 6064 and the team will handle it.
You can also simply not use the forms: the clinic’s phone number, WhatsApp and email are on every page, and none of them creates a record on this website at all — Analytics counts only that the link was pressed (see section 06).
If this notice changes, the change appears on this page. Material changes to what is collected or how long it is kept are made in the same release as the change itself, never after it.