Health Data Notice

This Health Data Notice explains how BioBlend Compounding Pharmacy handles your sensitive health and prescription information under the healthcare-data protection requirements of the United Arab Emirates, including the Ministry of Health and Prevention (MOHAP), the Dubai Health Authority (DHA) and the Emirates Health Establishment (EDE) framework. It applies alongside our Privacy Notice and Terms of Use.

1. What Is Health Data

For the purposes of this Notice "health data" means any information relating to your physical or mental health, including:

• Prescriptions, diagnoses, allergies, sensitivities and current medications.
• Laboratory results, screening responses and clinical history.
• Uploaded documents — ID cards, insurance cards, doctor's notes and prescriptions.
• Pharmacy records of compounding, dispensing, quality checks and adverse-event follow-up.

Health data is treated as sensitive data under UAE data protection law and is afforded the highest standard of protection.

2. Why We Process Health Data

We process health data only where necessary to provide pharmacy services to you and to meet regulatory duties:

1. To review, compound, dispense and deliver your medicines safely.
2. To verify clinical eligibility for restricted items and clinical services.
3. To coordinate with your prescriber, clinic or laboratory where relevant.
4. To maintain audit-ready pharmacy records (batch numbers, formulas, quality checks).
5. To fulfil pharmacovigilance, recall and adverse-event reporting obligations under MOHAP, DHA and EDE.
6. To meet licensing, inspection and regulatory compliance requirements.

We do not use health data for unrelated marketing or sell it to any third party.

3. Lawful Basis & Consent

1. We process health data on the basis of providing healthcare under UAE law and, where required, your explicit consent.
2. For clinical services such as IV therapy and peptide protocols you will be asked to consent before processing begins; you may withdraw consent at any time, which may limit our ability to provide a service.
3. Where processing is required by law (for example dispensing records or adverse-event reporting), your consent is not needed and we will process accordingly.

4. Minimum-Necessary Access Principle

1. Access to your health data follows a minimum-necessary principle — a staff member sees only the data needed for their role.
2. Pharmacist roles have access for review, compounding, dispensing and pharmacovigilance.
3. Prescribers see only the data you authorise us to share for coordination.
4. Support and administrative roles see masked or redacted previews where possible.

5. Secure Handling of Uploaded Documents

1. Prescriptions, ID documents, insurance cards and lab results are uploaded to private storage and accessed only via signed, time-limited URLs.
2. These documents are never published or indexed. We do not expose them on public URLs at any time.
3. We retain uploaded documents for the period required by UAE pharmacy regulation, then securely delete them.

6. Confidentiality of Communications

1. Messages between you and our pharmacy team are transmitted and stored securely.
2. Internal staff notes are not visible to patients.
3. Health or prescription content is never included in notification previews; previews are redacted to the minimum necessary.

7. Adverse-Event & Safety Reporting

1. As a licensed pharmacy we participate in pharmacovigilance and adverse-event monitoring as required by MOHAP, DHA and the EDE framework.
2. Where you report a suspected adverse event related to a compounded preparation or dispensed medicine, we may record it and, where required, report de-identified details to the relevant health authority.
3. Reporting is intended to protect patient and public safety and does not disclose your identity beyond what is strictly required.

8. Sharing With Health Authorities

1. We share health data with MOHAP, DHA or other competent health authorities where required by law, licence, inspection, recall or public-health duty.
2. For DHA-licensed activities in Dubai we comply with DHA data-handling and patient-confidentiality requirements.
3. We apply the minimum-necessary principle to any such disclosure.

9. Data Subject Rights

Unless restricted by health-sector and pharmacy regulation, you have the right to access your health data, request correction, request deletion (where retention is not legally required) and withdraw consent where applicable. Because health and dispensing records are subject to mandatory retention under UAE pharmacy law, certain data cannot be deleted before its retention period ends. To exercise any right, contact us at the details in our Privacy Notice.

10. Retention of Health Records

Pharmacy, prescription, compounding and dispensing records are retained for the period required by MOHAP, DHA and applicable UAE health-sector regulation. After the retention period, data is anonymised or securely destroyed.

11. Complaints

1. If you believe your health data has been mishandled, please contact us first at hello@bioblend.ae.
2. You also have the right to raise a concern with the competent UAE data-protection authority or the relevant health authority (MOHAP / DHA as applicable).

12. Changes to This Notice

We may update this Notice to reflect regulatory, licensing or operational changes; the "Last updated" date below indicates the latest revision. Continued use of our services after a change constitutes acceptance of the updated Notice.