1Introduction and Identity of the Data Controller
This Privacy Policy applies to MedhyaShield, an AI Powered Cybersecurity & Governance Platform operated by Medhyacom Technology, a company incorporated and registered in the United Arab Emirates ("we", "our", "us"). We are committed to protecting the personal data of our customers, platform users, website visitors and business contacts in accordance with applicable UAE data protection legislation, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations.
By accessing or using the MedhyaShield platform or website at medhyashield.com, you acknowledge and agree to the practices described in this Privacy Policy. If you do not agree, please do not use our platform or services.
2Personal Data We Collect
We collect the following categories of personal data when you interact with our platform and services:
- Account and identity data: Full name, email address, job title, company name, telephone number and business address provided during registration or account management.
- Platform usage data: Log data, IP addresses, browser type, device identifiers, session duration, pages visited, features accessed and actions taken within the MedhyaShield platform.
- Security and monitoring data: Endpoint telemetry, email security events, domain scan results, incident records, risk registers and compliance assessment data generated as part of the managed cybersecurity service.
- Billing and financial data: Name, billing address and payment information processed through our secure payment provider. We do not store full card numbers on our systems.
- Communications data: Emails, support tickets and messages exchanged between you and MedhyaShield personnel.
- Employee data: If you provide employee information for the purpose of configuring user accounts, training or endpoint management, we process this data solely as a data processor acting on your instructions.
3Legal Basis and Purpose of Processing
We process personal data under the following legal bases as recognised under UAE PDPL:
- Performance of contract: To provision, deliver and manage the MedhyaShield subscription services you have subscribed to.
- Legitimate interests: To monitor platform security, prevent fraud, improve our services and communicate service-related updates.
- Consent: For marketing communications, where we will always obtain your explicit consent and provide an easy mechanism to withdraw it.
- Legal obligation: Where processing is required to comply with applicable UAE laws, judicial orders or regulatory requirements.
4How We Share Your Personal Data
We do not sell, rent or trade your personal data to third parties. We share data only as follows:
- Service providers: Trusted third-party vendors who provide cloud infrastructure, payment processing, email delivery and customer support tooling, all bound by contractual data processing agreements.
- Security intelligence providers: Anonymised or aggregated threat data may be shared with threat intelligence partners to enhance detection capabilities.
- Legal and regulatory authorities: Where required by UAE law, court order or regulatory authority, we may disclose data to competent authorities.
- Business transfers: In the event of a merger, acquisition or sale of business assets, personal data may be transferred to the successor entity, subject to equivalent protections.
5Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable UAE laws and regulations. Account data is retained for the duration of your subscription and for a period of five (5) years thereafter for legal and audit purposes. Security event and incident data may be retained for up to seven (7) years in accordance with UAE cybersecurity regulatory guidance. You may request deletion of personal data subject to legal retention obligations.
6Data Security
We implement technical and organisational security measures commensurate with the sensitivity of the data we process. These include encryption in transit and at rest, role-based access controls, multi-factor authentication, regular penetration testing, security monitoring and incident response procedures. Notwithstanding these measures, no system is entirely immune from risk, and we cannot guarantee absolute security.
7Your Rights Under UAE PDPL
Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data:
- The right to access and obtain a copy of your personal data held by us.
- The right to rectify inaccurate or incomplete personal data.
- The right to request erasure of personal data where there is no lawful reason for continued processing.
- The right to object to processing carried out on the basis of legitimate interests.
- The right to withdraw consent where processing is based on consent.
- The right to lodge a complaint with the UAE Data Office or relevant supervisory authority.
To exercise any of these rights, please contact us at the address below. We will respond within thirty (30) days of receipt of your request.
8International Data Transfers
Where personal data is transferred outside the UAE, we ensure that appropriate safeguards are in place in accordance with UAE PDPL requirements, including standard contractual clauses or transfers to jurisdictions recognised as providing adequate protection. Data residency options may be available upon request for certain subscription tiers.
9Cookies and Tracking Technologies
Our website uses cookies and similar technologies to ensure functionality, analyse usage patterns and improve user experience. You may control cookie settings through your browser. Disabling certain cookies may affect the functionality of the website. We do not use cookies for cross-site advertising or sell cookie data to third parties.
10Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, applicable laws or regulatory guidance. We will notify registered users of material changes by email or platform notification at least fourteen (14) days before they take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.