Diversified Integrated Sports Clinic (“us”, “we”, or “our”) operates the DISC appointment booking platform and website for the DISC Kuwait clinic (the “Service”). Diversified Integrated Sports Clinic is a licensed healthcare operator in the State of Kuwait operating under the Diversified Integrated Sports Clinic brand.
This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service from Kuwait, and the choices you have associated with that data. By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Legal Framework and Data Controller
1.1 Applicable Law. The collection, processing, storage, and transfer of your personal data through our Services in Kuwait is governed by: Kuwait Law No. 20 of 2014 Regarding Electronic Transactions and its implementing regulations; applicable data privacy provisions under Communications and Information Technology Regulatory Authority (CITRA) guidelines; Kuwait Ministry of Health regulations applicable to healthcare providers; and any other applicable Kuwaiti federal or sectoral laws. References in this Policy to “Applicable Law” mean the foregoing Kuwaiti laws and regulations.
1.2 Data Controller. Diversified Integrated Sports Clinic is the Data Controller responsible for your personal data collected through the Kuwait Service. Our Data Protection contact can be reached via the Contact Us page on our website.
2. Information Collected and Use
We collect the following categories of personal data solely for the purpose of facilitating appointment booking and verifying patient identity:
2.1 Personal Identification Data
- Full name
- Date of birth
- Kuwaiti Civil ID number or equivalent national identification number
- Health insurance provider name and policy/membership number
- Mobile phone number
- Email address
2.2 What We Do NOT Collect Through This Platform
Scope Limitation. The appointment booking platform does not collect, store, or process clinical or medical data of any kind, including medical records, diagnoses, prescriptions, treatment notes, allergies, or any other health information. Any medical information related to your care at DISC Kuwait is held under separate clinical information governance systems and is not part of this platform.
2.3 Usage and Technical Data
We may collect technical data about how the Service is accessed and used, including IP address, browser type, browser version, pages visited, time and date of visit, and device identifiers. This is used for security monitoring, service improvement, and compliance purposes.
2.4 Cookies
We use the following types of cookies:
- Session Cookies: to operate our Service during your active session;
- Preference Cookies: to remember your preferences and settings;
- Security Cookies: to support authentication and protect against fraud.
You can instruct your browser to refuse all cookies. However, if you do not accept cookies, you may not be able to use some portions of our Service.
3. Legal Basis for Processing
3.1 Consent. We rely on your explicit consent, provided at the point of registration, as the primary legal basis for collecting and processing your personal data. You may withdraw consent at any time by contacting us, though this may affect your ability to use the booking service.
3.2 Contractual Necessity. Processing of your name, contact details, date of birth, Civil ID, and insurance information is necessary to fulfil your appointment booking request.
3.3 Legal Obligation. We may process your data to comply with applicable Kuwaiti legal obligations, including requirements under the Ministry of Health, CITRA, or other competent Kuwaiti authorities.
4. One-Time Password (OTP) Delivery
4.1 OTP Channels. We use OTP codes to verify your identity when logging in or confirming bookings. These OTPs are delivered via SMS (through licensed Kuwaiti telecommunications operators) or WhatsApp.
4.2 WhatsApp / Meta Processing. If you elect to receive OTPs via WhatsApp, your mobile phone number will be processed by Meta Platforms, Inc. as the operator of WhatsApp. This involves the transfer of your phone number to Meta’s servers, which may be located outside Kuwait. By opting to receive OTPs via WhatsApp, you consent to this transfer. You may opt for SMS delivery at any time to avoid this cross-border transfer.
4.3 OTP Retention. OTP codes are ephemeral and are not stored by us beyond the authentication window (typically 5 minutes). We do not retain records of OTP codes after they have been used or expired.
5. Use of Data
We use the collected data for the following purposes:
- To provide and maintain the appointment booking Service;
- To verify your identity before granting access to the Patient Portal;
- To confirm, reschedule, or cancel your appointments;
- To send appointment reminders via SMS, WhatsApp, or email;
- To notify you about changes to our Service;
- To provide customer care and support;
- To monitor the usage and security of the Service;
- To detect, prevent and address technical issues or fraud;
- To comply with applicable Kuwaiti legal and regulatory obligations.
6. Data Retention
6.1 Retention Period. We retain your personal data collected through the appointment booking platform for a period of five (5) years from your last interaction with the Service, or for such longer period as required by applicable Kuwaiti law or Ministry of Health regulations, whichever is longer.
6.2 Deletion and Anonymisation. Upon the expiry of the applicable retention period, or upon receipt of a valid erasure request, your personal data will be securely deleted or anonymised so that it can no longer be attributed to you.
7. Transfer and Storage of Data
7.1 Data Residency. Your personal data is stored on servers located within Kuwait and/or the United Arab Emirates. Diversified Integrated Sports Clinic takes all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.
7.2 Third-Party Transfers. Your personal data may be transferred to third-party service providers (such as SMS gateways, and cloud hosting providers) who process data on behalf of Diversified Integrated Sports Clinic. All such providers are required to enter into Data Processing Agreements with us and are obligated not to use your data for any purpose other than providing services to us.
7.3 Cross-Border Transfers. Where data is transferred to a country outside Kuwait, we will ensure that adequate protections are in place. See Section 4.2 regarding WhatsApp/Meta data transfers.
7.4 Legal Disclosure. We will not disclose your personal data except: (a) with your authorisation; (b) as required by Kuwaiti law or court order; (c) to protect and defend the rights or property of Diversified Integrated Sports Clinic; (d) to prevent or investigate wrongdoing in connection with the Service; or (e) to protect the personal safety of users or the public.
8. Analytics and Third-Party Services
8.1 Google Analytics. We may use Google Analytics, a web analytics service provided by Google LLC, to monitor and analyse website traffic. Data collected by Google Analytics may be transferred to Google’s servers outside Kuwait. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. By continuing to use our website, you consent to analytics data being processed by Google subject to Google’s Privacy Policy.
9. Security of Data
We implement appropriate technical and organisational security measures to protect your personal information, including:
- TLS encryption for all data transmitted between your device and our servers;
- Encryption at rest for stored personal identifiers including Civil ID and insurance information;
- Role-based access controls restricting staff access to booking data;
- Audit logging of data access events;
- Regular security assessments.
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
10. Data Breach Notification
10.1 Internal Response. Diversified Integrated Sports Clinic maintains an incident response procedure for personal data breaches in accordance with Kuwaiti law and Ministry of Health requirements.
10.2 Notification to Regulators. In the event of a personal data breach, we will notify CITRA and/or the Kuwait Ministry of Health within the timeframes required by applicable Kuwaiti law.
10.3 Notification to You. Where a breach is likely to result in a significant risk to your rights and freedoms, we will notify you directly without undue delay using the contact details you provided at registration.
11. Your Data Protection Rights
Under applicable Kuwaiti law, you have the following rights regarding your personal data:
- Right to be informed about how your personal data is processed;
- Right to access a copy of the personal data we hold about you;
- Right to correct inaccurate or incomplete personal data;
- Right to request erasure of your personal data where there is no legitimate basis to retain it;
- Right to object to or restrict processing of your personal data;
- Right to withdraw your consent at any time;
- Right to lodge a complaint with CITRA or the relevant Kuwaiti supervisory authority.
To exercise any of the above rights, please contact our Data Protection contact via the Contact Us page on our website. We will respond to all verified requests within 30 calendar days. We may ask you to verify your identity before processing your request.
12. Minors
The appointment booking Service is intended for use by individuals aged 18 and over. Where an appointment is being booked on behalf of a minor or a dependent, the parent or legal guardian must use their own account and confirm they are authorised to act on behalf of that individual. We do not knowingly collect personal data directly from minors under the age of 18 without parental or guardian consent.
13. Links to Other Sites
Our Service may contain links to other sites not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the Privacy Policy of every site you visit.
14. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date. For material changes, we will provide a prominent notice on our Service prior to the change becoming effective.
15. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your personal data is handled, please contact Diversified Integrated Sports Clinic via the Contact Us page on our website.
Consent. By continuing to use our Service, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to any term or condition of this Privacy Policy, you may not be able to access all features of the Service.