Data Controller
Who is responsible for your data
One Click Away is a hospital operations platform operated by Omer Ali Siddiq, based in Dubai, United Arab Emirates. Controller and processor roles depend on the data, deployment, and signed hospital agreement and are confirmed before production use.
Contact for data requests: support@1clickaway.xyz · +971 55 602 7771
Requests are identity-verified and handled under applicable law and the relevant hospital agreement.
Data We Collect
What information we process and why
We process two distinct categories of data depending on whether you are a visitor to our marketing website or a staff user of the operational platform.
| Category | Data fields | Purpose | Deployment requirement |
|---|---|---|---|
| Marketing website visitors | Name, email, hospital name, message (contact form); anonymised usage data via Google Analytics (page views, session duration, browser type) | Respond to demo requests; understand which content is useful | Purpose and lawful basis documented before collection |
| Hospital staff accounts | Full name, role, department, mobile number (optional); FCM device token for push notifications; login timestamps | Account authentication, request dispatch, push notifications | Hospital instructions and signed service agreement |
| Operational requests | Room number, language required, department, request status, timestamps at each stage | Dispatch, tracking, audit reporting for the hospital | Hospital instructions and approved workflow |
Data minimisation: The platform is designed for operational coordination rather than clinical records. Patient identifiers, diagnoses, and treatment notes are not required fields. The deployment data inventory and staff training must prevent unnecessary clinical content from being entered into free-text fields.
Retention
How long we keep data
| Data type | Retention period |
|---|---|
| Contact form submissions | Defined in the marketing data-retention schedule |
| Staff account data | Defined in the hospital agreement and deprovisioning procedure |
| Operational request records | Defined by the hospital's approved retention schedule |
| Website analytics, where enabled | Configured and documented before collection |
| Audit logs | Defined by security, legal, and operational requirements |
Sub-Processors
Third parties we use to deliver the service
The services below may support the current platform. The exact subprocessor list, processing purpose, region, contractual safeguards, and approval status are disclosed and agreed for each production deployment.
| Sub-processor | Location | Purpose |
|---|---|---|
| Google LLC (Firebase) | Deployment-specific | Authentication, operational datastore, and audit records |
| Google LLC (FCM) | Deployment-specific | Push notifications to approved staff devices |
| Google LLC (Analytics) | Configuration-specific | Marketing website analytics, where enabled |
| Supabase Inc. | Deployment-specific | Server-side notification relay |
| Vercel Inc. | Deployment-specific | Hosting and delivery of public application files |
| Formspree Inc. | Configuration-specific | Marketing contact forms, where enabled |
Data residency: No residency location is promised by this public notice. Hosting regions and transfer paths must be verified and committed in writing before a hospital deployment is approved.
International Transfers
Transfers outside the UAE
International-transfer requirements depend on the configured service regions and the hospital's legal obligations. Transfer paths, lawful mechanisms, vendor terms, and residual risks are reviewed and recorded before production use.
A deployment is not represented as UAE- or KSA-resident unless that commitment appears in the signed agreement and is supported by verified cloud configuration.
Cookies & Analytics
How we use cookies on the marketing site
Where analytics is enabled, the marketing website may collect limited usage information such as page views, session duration, browser type, and approximate country. The active configuration and consent requirements are reviewed before deployment.
- Analytics cookies are used on the marketing site only — never inside the operational hospital app.
- No advertising or retargeting cookies are used.
- You can opt out of Google Analytics at any time via your browser settings or the Google Analytics Opt-out Browser Add-on.
Your Rights
Rights under UAE PDPL
Under Federal Decree-Law No. 45 of 2021 (UAE Personal Data Protection Law), you have the following rights regarding personal data we hold about you:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate or incomplete data.
- Deletion — request deletion where the right applies, subject to legal and contractual retention duties.
- Restriction — request that we limit how we use your data in certain circumstances.
- Portability — request your operational data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
To exercise a right that applies to your data, email support@1clickaway.xyz with the subject line "Data Request". Identity, authority, scope, exemptions, and response timing are assessed under applicable law and the relevant hospital agreement.
Concerns may also be raised through the competent UAE authority where applicable.
Security
How we protect your data
- Supported production traffic is intended to use HTTPS/TLS in transit.
- Operational access is designed to be restricted by authenticated identity, hospital scope, and role.
- Vendor assurance evidence is reviewed as part of deployment due diligence.
- Production staff access is intended to be provisioned and deprovisioned by authorised administrators.
Policy Updates
Changes to this policy
We may update this notice when practices or legal requirements change. Material client notices follow the signed agreement and applicable law. The date at the top of this page reflects the latest public revision.