Privacy Policy

1. Data Controller

Cliniform Medical Clinic is the data controller for all personal data processed in connection with its clinical services, marketing, and website. Our contact details are provided in the “How to Contact Us” section below.

2. Personal Data We Collect

We collect the following categories of data:

2.1 Data you provide directly

• Identity data: full name, date of birth, gender, nationality.
• Contact data: phone number, WhatsApp number, email address, postal address.
• Identification document data, where required for registration, insurance, or surgical intake.
• Health and medical data: medical history, current medications, allergies, diagnoses, treatment plans, consent forms, photographs taken for clinical, follow-up, or “before and after” documentation.
• Payment data: amounts, receipts, and basic transaction references. We do not store complete payment card numbers; card transactions are handled directly by licensed payment processors.
• Content you submit through contact forms, newsletter signup, email, WhatsApp, or phone.

2.2 Data collected automatically through the website

• Technical data: IP address, device type, browser type and version, operating system, referring URL, approximate location derived from IP.
• Usage data: pages visited, buttons and links clicked, time spent, error logs.
• Cookies and similar technologies as described in our Cookie Policy.

3. Purposes and Legal Bases

Under Article 87 of Law 81/2018 and related provisions, personal data must be processed for specified, explicit, and legitimate purposes. We process your data for the following purposes, relying on the legal bases indicated:

• Providing medical services(consultation, diagnosis, treatment, follow-up, and record-keeping) — performance of the service you have requested and compliance with medical record-keeping obligations under Lebanese law.
• Appointment booking and communication(phone, WhatsApp, email) — performance of our service and your explicit consent.
• Processing sensitive health data— your explicit, informed consent and the necessity of that processing for preventive medicine, medical diagnosis, and the provision of healthcare, by or under the responsibility of a licensed professional bound by medical confidentiality.
• Payment processing, invoicing, and accounting — compliance with Lebanese tax, accounting, and commercial law.
• Marketing and newsletters— only with your prior, freely given consent, which you may withdraw at any time.
• Website operation, security, and fraud prevention — our legitimate interest in running a safe, functional website.
• Legal and regulatory compliance, including responding to lawful requests from Lebanese authorities.

4. Medical Confidentiality

Medical data is subject to professional secrecy under Lebanese medical law and the Code of Ethics of the Lebanese Order of Physicians. Access to medical records is strictly limited to the clinicians and authorised staff involved in your care. No medical data is used for marketing purposes, sold, or disclosed to third parties without your explicit, informed consent or a specific legal obligation.

5. Photographs and “Before and After” Content

Clinical photographs are taken only when medically relevant. Any use of your photographs outside your personal medical record — for example, in our “Before & After” gallery, website, or social media — requires a separate, written consent form which you may refuse or revoke at any time without effect on your care.

6. How We Share Data

We do not sell personal data. We may share data only as follows:

• With clinicians, nurses, and administrative staff of Cliniform who need the data to provide or support your care, each bound by confidentiality.
• With external specialists, laboratories, hospitals, or imaging centres for the purpose of a referral, second opinion, or continued care — with your informed consent.
• With service providers acting on our behalf under written confidentiality commitments: web hosting, email delivery, IT maintenance, analytics, communications, accounting.
• With payment institutions and insurers strictly to process payment or reimbursement you have requested.
• With competent Lebanese authorities (judicial, regulatory, tax, health) when required by a valid legal obligation or order.
• In case of reorganisation, merger, or transfer of the clinic, subject to the continued protection of your data under this Policy or an equivalent one.

7. International Transfers

Some of the technical service providers that host our website, handle our email, or power our communication tools are based outside Lebanon. When personal data is transferred internationally, we require those providers, by contract, to apply security and confidentiality standards at least equivalent to those required under Lebanese law, and we limit transfers to what is strictly necessary.

8. Retention

• Medical records and related clinical documentation are retained for at least the minimum period required by Lebanese medical and commercial law, and for as long as needed for your continued care.
• Financial and tax-related records are retained for the periods required by Lebanese tax and accounting rules.
• Marketing contact data is retained until you withdraw consent or ask to be removed from our lists.
• Website analytics data is retained for a limited period proportionate to the purpose (typically up to fourteen months) and then deleted or aggregated.

9. Your Rights

Under Law 81/2018 and applicable medical regulations you have the following rights in respect of your personal data:

• Right of access— to obtain confirmation of whether we process your data and to receive a copy.
• Right of rectification— to have inaccurate or incomplete data corrected.
• Right of deletion— to request deletion of data that is no longer necessary, subject to our medical, legal, and accounting record-keeping obligations.
• Right to object— in particular, to object to any processing for direct marketing.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal, and without affecting the continuity of your medical care.
• Right to lodge a complaint with the competent Lebanese authority (currently the Ministry of Economy and Trade, as designated under Law 81/2018) if you consider that your rights have been violated.

To exercise any of these rights, contact us using the details in section 12. We may need to verify your identity before acting on a request.

10. Security

We implement technical and organisational measures appropriate to the sensitivity of the data, including restricted access, authentication, encryption in transit for our website, secure storage of medical files, staff confidentiality commitments, and training. No system is entirely risk-free; we continually review and improve our safeguards.

11. Children

The website is not directed to persons under the age of eighteen without the involvement of a parent or legal guardian. For minors receiving clinical care, consents and communications are handled through the parent or legal guardian in accordance with Lebanese law.

12. How to Contact Us

For any question about this Policy, or to exercise your rights:

• Address: Tabaris Center 1063, 5th floor, Achrafieh, Beirut, Lebanon.
• Phone: +961 1 330 633 · +961 21 330 533 · +961 70 330 040.
• WhatsApp: +961 3 594 063.
• Email: please use the contact form on our website or ask at reception for the current data-protection contact address.

13. Governing Law and Jurisdiction

This Policy is governed by the laws of the Republic of Lebanon. Any dispute arising from or relating to it falls under the exclusive jurisdiction of the competent courts of Beirut, without prejudice to any mandatory rules that may apply.

14. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top of the page indicates the latest version. Material changes will be highlighted on the website and, where appropriate, communicated directly.