This Privacy & Data Protection Policy explains how Rafaaya FZ-LLC (“Rafaaya”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data when individuals use the Rafaaya mobile application, rafaaya.net, related customer and Provider interfaces, and Rafaaya support services (together, the “Platform”).

Rafaaya FZ-LLC is the controller of personal data for the Platform where Rafaaya determines the purposes and means of processing. Independent service Providers may also act as separate controllers for personal data they need to perform their own services, particularly regulated healthcare services.

This Policy is intended to operate in accordance with applicable UAE data-protection and privacy laws, including Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data (“UAE PDPL”), together with other applicable sector-specific requirements.

2. Who may use Rafaaya

Rafaaya customer accounts are for individuals aged 18 or over. Rafaaya does not knowingly permit children to create their own accounts.

An adult parent or legal guardian may book an appropriate service for a child where the Provider permits that service and applicable law and professional rules allow it. The adult is responsible for providing any required consent and information to the Provider.

3. Personal data we collect

3.1 Account and identity information

• name, mobile number and email address;

• profile photograph;

• Emirates ID details and an uploaded image used for identity verification;

• date of birth, nationality, gender or similar information only where necessary for a particular lawful purpose or service;

• account credentials, verification status and account security information.

At launch, Emirates ID verification may be carried out manually by authorised Rafaaya personnel. Once the identity check is completed, Rafaaya intends to delete the uploaded ID image unless continued retention is required for a legal, fraud, dispute or regulatory reason. Rafaaya may later introduce a specialist identity-verification provider and will update this Policy or related notices where appropriate.

3.2 Address and location information

• full service addresses, including villa, building, apartment or unit details;

• saved addresses and customer labels such as Home or other user-selected labels;

• access, gate, parking and property instructions;

• location information used when a customer first enters or confirms an address, where permission is granted;

• Provider or Provider-employee location information where the Provider employee enables location access for operational purposes.

Rafaaya does not intend to continuously track a customer’s live location. Location functionality is intended primarily to assist with accurate address entry and booking fulfilment.

A Provider’s routine access to the customer’s service address should end immediately after completion of the booking. Rafaaya may retain the address as part of the booking record for the periods described in this Policy.

3.3 Booking and service information

• services selected, Provider, date, time and booking status;

• booking changes, cancellations, completion status and customer OTP confirmation records;

• tips, refunds, complaints and dispute outcomes;

• customer instructions and information reasonably necessary to perform the service;

• ratings, reviews and the customer’s first name displayed with a public review.

Customers cannot upload photographs with public reviews under the current operating model.

3.4 Payment and transaction information

Rafaaya uses Stripe for payment processing. Rafaaya does not intend to store full payment-card numbers, CVV security codes or raw Apple Pay or Google Pay credentials. Stripe and relevant financial/payment partners process payment data under their own roles and privacy terms.

Rafaaya may retain transaction information such as amount, date, currency, payment status, payment token/reference, limited card or wallet descriptors where supplied, refund information, chargeback information and records needed for reconciliation, fraud prevention, accounting and customer support.

3.5 Communications and support information

• in-app messages between customers and Providers;

• communications with Rafaaya support or administration;

• email notifications and delivery/status information;

• call-routing or masked-call information where in-app calling is enabled;

• complaint evidence, including relevant photographs and messages supplied to Rafaaya.

Rafaaya may retain in-app messages so that it can support bookings, investigate complaints, protect users, prevent abuse and resolve disputes.

3.6 Provider information

For Providers and their personnel, Rafaaya may collect business and professional information including trade licence details, passport or Emirates ID information, visa/work authorisation where relevant, professional licences, qualifications, insurance details, bank/settlement information, tax/VAT information, named-professional information, profile photographs, ratings and compliance records.

3.7 Device, technical and website information

Rafaaya may collect technical information such as IP address, device and operating-system information, app version, login and security events, identifiers, diagnostic information, website activity and cookie data. Analytics tools are still to be finalised. Any material analytics or tracking technologies introduced will be reflected in this Policy and the Rafaaya Cookie Policy as appropriate.

4. Healthcare and sensitive information

Rafaaya is designed to minimise the clinical information it handles. A booking may identify a service such as “Home GP appointment”, “IV therapy” or “physiotherapy”, but Rafaaya does not intend to collect symptoms, medical history, allergies, prescriptions, clinical questionnaires, diagnoses, treatment notes or medical records through the Platform.

Clinical and medical information required to provide a regulated healthcare service should be collected directly by the licensed healthcare Provider through its own appropriate systems and processes. The Provider is responsible for explaining why additional identity or health information is required and for complying with applicable healthcare and privacy requirements.

Rafaaya does not routinely disclose customer Emirates ID information to Providers. Where a healthcare Provider legally requires additional identity information, the Provider should liaise directly with the customer and expressly explain the requirement.

5. How we use personal data

Depending on the context and applicable law, Rafaaya may process personal data to perform a contract, take steps requested before entering a contract, comply with legal obligations, protect legitimate interests where permitted, protect individuals and the Platform, or on the basis of consent where consent is required.

We use personal data to:

• create, verify, secure and administer accounts;

• verify identity and Provider credentials;

• enable customers to find, request, pay for and complete bookings;

• provide Providers with information necessary to fulfil accepted bookings;

• process payments, tips, settlements, refunds and chargebacks;

• send transactional emails and Platform notifications;

• enable in-app messaging and, where introduced, masked calling;

• administer OTP completion and booking records;

• provide customer support and investigate complaints, property-damage reports and disputes;

• detect and prevent fraud, circumvention, abuse, security incidents and unlawful activity;

• moderate reviews and maintain service quality;

• rank or recommend Providers using factors such as location, availability, rating, service category and price;

• maintain accounting, tax, legal and regulatory records;

• protect and enforce Rafaaya’s rights and contractual terms;

• improve, maintain, secure and troubleshoot the Platform; and

• comply with lawful requests from courts, regulators and competent authorities.

6. Automated ranking and artificial intelligence

Rafaaya may automatically rank or recommend Providers using operational factors such as service location, availability, rating, service category and price. This functionality is intended to help customers navigate the marketplace.

Rafaaya does not currently use an AI customer-support chatbot and does not intend to use customer conversations or personal data to train Rafaaya-owned AI models. If this changes materially, Rafaaya will update its disclosures and obtain consent where required.

7. Marketing

Rafaaya does not currently intend to send direct marketing at launch. If marketing email, SMS, WhatsApp or push campaigns are introduced, Rafaaya intends to use an opt-in approach where required and will provide a way to unsubscribe or withdraw marketing consent.

Rafaaya does not currently use previous booking history to send personalised service offers. Providers may not use Rafaaya-derived customer information for their own marketing unless the customer separately and expressly consents in a legally valid manner.

Rafaaya does not sell personal data to third parties for monetary consideration.

8. When we share personal data

Rafaaya shares personal data only where reasonably necessary for the Platform, a booking, security, legal compliance or another purpose described in this Policy. Recipients may include:

• the Provider selected for a booking, including the customer’s name, service address, booking details and necessary access instructions;

• Stripe, banks, card networks, wallet providers and other payment participants;

• cloud hosting and infrastructure providers;

• email, push-notification and communications providers;

• future identity-verification providers if introduced;

• analytics, diagnostics or security providers if introduced;

• insurers where a claim or incident requires it;

• professional advisers such as lawyers, accountants and auditors;

• regulators, courts, law-enforcement bodies and other competent authorities where disclosure is lawful or required;

• fraud-prevention, cybersecurity and incident-response providers; and

• a buyer, investor, successor or adviser in connection with a genuine corporate financing, restructuring, merger, acquisition or sale, subject to appropriate confidentiality and legal safeguards.

Providers do not ordinarily receive the customer’s telephone number or Emirates ID details as standard booking fields. Providers are prohibited from downloading or building customer lists from Rafaaya data or using customer data outside authorised purposes.

9. Payments and Stripe

Stripe processes payment and transaction data required to provide payment services, prevent fraud and handle disputes. Stripe may act as a processor and/or controller depending on the particular processing activity. Stripe’s current privacy materials also explain that payment data may be processed or transferred internationally through Stripe, its affiliates, financial partners and subprocessors.

Because payment infrastructure may involve processing outside the UAE, Rafaaya will rely on appropriate contractual, legal and organisational safeguards for cross-border transfers where required by UAE law. Customers should also review Stripe’s applicable privacy information for its own processing activities.

10. International data transfers and hosting

Rafaaya intends to host its principal application/database infrastructure in the UAE using Amazon Web Services (“AWS”), subject to final technical confirmation before publication. Rafaaya’s developers in India are not intended to have routine access to live customer personal data.

Some service providers, particularly payment, communications, security or technology providers, may process personal data outside the UAE. UAE law places conditions on transfers of personal data outside the State. Rafaaya will use transfer mechanisms and safeguards required by applicable law, which may include transfers to jurisdictions with an appropriate protection level, contractual safeguards, explicit consent where legally appropriate, or another lawful transfer basis.

11. Cookies and similar technologies

rafaaya.net may use cookies and similar technologies for essential website functions, security, preferences and, if introduced, analytics. Rafaaya will maintain a separate Cookie Policy describing the cookies and tracking technologies in use and will obtain cookie consent where required.

Rafaaya does not currently intend to use Meta, Google or similar advertising tracking for personalised advertising. If this changes, the relevant disclosures and consent controls will be updated before or when such technology is introduced.

12. Reviews and public information

Customer reviews may be visible to other Platform users. Under the current design, only the customer’s first name is intended to appear with the review. Customers should not include personal, confidential, medical or third-party information in review text.

Rafaaya may moderate or remove reviews in accordance with its Terms of Use. Public review content may remain visible for legitimate marketplace purposes unless removed under applicable law or Rafaaya policy.

13. Data retention

Rafaaya keeps personal data only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, tax, fraud-prevention, dispute and regulatory requirements. Retention periods may vary by record and applicable law.

At the end of an applicable retention period, Rafaaya will delete, anonymise or securely dispose of personal data unless continued retention is required or permitted by law.

14. Account deletion

Customers may request account deletion through the Platform where that functionality is available. Deleting an account does not necessarily mean that every record can be erased immediately.

Rafaaya may retain transaction, invoice, booking, fraud, security, complaint, dispute and legal records where retention is required or reasonably necessary for compliance, establishment or defence of legal claims, prevention of abuse, accounting or other lawful purposes. Data that no longer needs to identify the individual may be anonymised where appropriate.

15. Your data-protection rights

Subject to the UAE PDPL, applicable exceptions and verification of identity, individuals may have rights relating to their personal data, including rights to obtain information about processing, request transfer or a copy of personal data, request correction of inaccurate data, request erasure in applicable circumstances, restrict or stop certain processing, object to certain automated processing, and withdraw consent where processing is based on consent.

Rights are not absolute. Rafaaya may need to retain or continue processing information where permitted or required by law, including for legal claims, fraud prevention, contractual records or regulatory obligations.

To exercise a privacy right, contact Rafaaya initially through support or by email. Data-access requests will initially be handled through email/support rather than an automated download tool.

16. Security

Rafaaya uses or intends to use reasonable technical and organisational measures appropriate to the nature of the personal data and risks involved. These include:

• encryption of personal data in transit and at rest;

• two-factor authentication for Provider and administrative accounts;

• OTP verification for customer mobile/email account security;

• role-based access so staff see information appropriate to their responsibilities;

• restricted access to identity documents and sensitive records;

• logging, monitoring and security controls;

• payment processing designed so Rafaaya does not store full card numbers or CVV;

• secure deletion or access removal when information is no longer needed; and

• contractual and security controls for relevant service providers.

No system can be guaranteed completely secure. Rafaaya will investigate suspected security incidents and take notification or remediation steps required by applicable law.

17. Internal access and confidentiality

Initially, access to customer information is intended to be limited to authorised Rafaaya administration and support personnel who need it for account administration, identity verification, booking support, disputes, security or compliance.

Access should be role-based and limited to the minimum reasonably necessary. Rafaaya’s software developers in India are not intended to have routine access to live customer personal data. Any exceptional access introduced in the future should be controlled, logged, contractually protected and assessed for cross-border transfer compliance.

18. Data breaches and incidents

If Rafaaya becomes aware of a personal-data breach or security incident, it will investigate, contain and remediate the incident and will notify the competent authority and/or affected individuals where and within the timeframe required by applicable law.

Providers must promptly report suspected loss, misuse or unauthorised disclosure of Rafaaya customer data in accordance with the Service Provider Marketplace Agreement.

19. Provider responsibilities

Independent Providers receive personal data to fulfil bookings and may have their own legal responsibilities as controllers of information they collect directly. Providers must use Rafaaya-derived customer information only for authorised booking, safety, support and legal purposes and must not use it for independent marketing without separate valid consent.

Healthcare Providers are responsible for the privacy and security of clinical information they collect directly and for providing any privacy notices required for their own processing.

20. Changes to this Policy

Rafaaya may update this Policy to reflect changes to the Platform, technology, Providers, payment arrangements, legal requirements or privacy practices. The updated version will state its effective or last-updated date. Material changes may be communicated through the Platform, email or another reasonable method where required.

21. Contact and complaints

Rafaaya FZ-LLC is the privacy contact and controller for Platform processing described in this Policy.

Privacy requests and questions may be sent to [email protected]. Customers may also contact Rafaaya through the support channel in the Platform.

Registered address for this draft: Compass Building, Al Hulaila, United Arab Emirates. This should be verified against Rafaaya FZ-LLC’s final RAKEZ licence before publication.

Individuals may also have the right under applicable UAE law to complain to the competent UAE data-protection authority regarding an alleged violation of data-protection law.

22. Documents to read with this Policy

• Rafaaya Terms of Use and Customer Terms & Conditions;

• Rafaaya Cancellation, Refund & Dispute Policy;

• Rafaaya Cookie Policy (to be prepared);

• for Providers, the Rafaaya Service Provider Marketplace Agreement;

• any service-specific or consent notice presented when information is collected.