This Privacy Notice explains how Limb Limited (Limb, we, us, our) collects, uses, shares and protects personal data when you (a licensed physiotherapist, practitioner, doctor or other healthcare professional, or a member of a rehabilitation centre or clinic using the Limb platform) use our website at https://limb.ae and the Limb platform web application (the Platform).
This Privacy Notice is provided to comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its executive regulations. Where you are based outside the United Arab Emirates, additional data protection laws may apply, and we apply those laws to the extent they are applicable to our processing of your personal data.
This Privacy Notice forms part of the Limb Terms and Conditions (the Terms) which you accept when you sign up to the Platform. Capitalised terms used in this Privacy Notice and not defined here have the meaning given in the Terms.
Limb operates in two distinct data protection roles.
(a) Personal data of Users and Authorised Users. When an Individual User, an Organisation Administrator or an Authorised User creates an Account on the Platform, signs in, uses the Platform or contacts us, Limb collects personal data about that person. For this personal data, Limb is the data controller. This Privacy Notice describes how Limb processes that personal data in that capacity.
(b) Patient personal data. When the Platform is used to design exercise programmes for Patients and to monitor their progress, the Platform may process personal data about Patients, including health data. For this Patient personal data:
(i) if you are an Individual User, you are the data controller and Limb is your processor; and
(ii) if you are an Organisation, the Organisation is the data controller and Limb is the Organisation's processor; the Organisation's Authorised Users handle Patient personal data on the Organisation's behalf and on the Organisation's instructions.
In each case the controller decides why and how Patient personal data is processed, and Limb processes Patient personal data only on the controller's documented instructions, as set out in the Limb Terms and Conditions (clause 8) and in any Data Processing Terms made available within the Platform. Limb does not use Patient personal data to make any clinical decision in respect of any Patient.
Limb's role as processor of Patient personal data is governed by the Terms and the Data Processing Terms, not by this Privacy Notice. The rest of this Privacy Notice deals with Limb's role as controller of personal data about Individual Users, Organisation Administrators and Authorised Users.
Limb is Limb Limited, a limited liability company incorporated under the Masdar City Companies Registration Regulations 2009, holding economic licence number MC 13277, with its registered office at VD Building 1B, 3rd Floor, Masdar City, Abu Dhabi, United Arab Emirates.
For any question about this Privacy Notice or about how we process your personal data, contact us at legal@limb.ae.
If you would like to exercise any of the rights set out in clause 9, please write to us at the same address with reasonable detail of your request and a means to verify your identity.
We collect and process the following categories of personal data about you:
Identification and contact data. Your name, professional title, professional licence number and licensing authority, email address, mobile number, country of practice, and the name of any clinic, rehabilitation centre or employer with which you are associated. We use this data to provide the Platform and to communicate with you.
Account data. Your username, password (stored only in encrypted form), your Account settings, preferences, language, time zone, profile picture (if you choose to upload one) and any other information you provide when you set up or manage your Account.
Verification data. Any information you provide to evidence your professional registration and your eligibility to use the Platform, including copies of any professional licence or registration certificate.
Usage and engagement data. Information about how you use the Platform, including the pages and features you access, the date and time of your sessions, the duration of your sessions, the actions you take (such as creating a Bespoke Exercise or prescribing an exercise programme), any errors encountered, and any settings you change.
Device and connection data. Information about the device and connection you use to access the Platform, including the make and model of the device, operating system version, browser type and version, language settings, IP address, mobile network information, and approximate location derived from IP address.
Content data. Any content you submit through the Platform, including the configuration of any Bespoke Exercise you create, any text, video, audio or image you upload, any feedback or rating you give, and any communication you send to us.
Communication and support data. The content of any email, support ticket, chat, call or survey response you exchange with us, and the date, time and channel of any such communication.
Payment data (in any paid plan). When you sign up to any paid plan after the Trial, we collect billing data including your billing name and address, payment instrument details (processed by our payment processor), and a record of your subscription and payments.
We do not collect any special category personal data about you (such as data about your health, religion or political opinions) unless you choose to provide it.
We collect personal data:
(a) directly from you, when you create your Account, log in, complete forms, upload content, set up Bespoke Exercises, communicate with us or otherwise use the Platform;
(b) automatically, when you access or interact with the Platform (for example, log entries, device data, usage data);
(c) from any rehabilitation centre, clinic, employer or other organisation that arranges your access to the Platform (for example, where you are an Authorised User and your Organisation has procured the Platform on your behalf under the Center Plan or the Enterprise Plan); and
(d) from third parties who lawfully provide us with your personal data (for example, licensing-authority verification services or payment processors.
We use your personal data only for the purposes set out below. Each purpose has a lawful basis under the PDPL. Where a special category lawful basis is required (for example, for any health-related data), we identify that separately.
To provide the Platform and your Account. We use your identification, contact, account, verification, device and content data to create and manage your Account, to authenticate you, to deliver the Platform, to enable you to use the AI Engine and the Exercise Library, to enable you to create Bespoke Exercises, and to provide support. Lawful basis: performance of a contract with you (the Terms).
To verify your eligibility to use the Platform. We use your verification data to confirm that you are a duly licensed healthcare professional in good standing. Lawful basis: legitimate interests (to ensure that the Platform is used only by qualified practitioners and to protect patient safety) and compliance with legal obligations applicable to us.
To communicate with you about the Platform. We use your contact data to send you operational messages about the Platform, security alerts, updates to the Terms or this Privacy Notice, and responses to your queries. Lawful basis: performance of a contract with you and legitimate interests.
To improve the Platform and develop new features. We use usage, engagement, device and content data, in aggregated and anonymised form wherever practicable, to monitor the performance of the Platform, identify bugs and friction, plan new features and develop new versions. Lawful basis: legitimate interests (to operate and improve the Platform).
To train and improve the AI Engine. We use Bespoke Exercises and usage data, in accordance with clause 7 of the Terms and on an anonymised or aggregated basis where practicable, to train, validate and improve the AI Engine. Lawful basis: legitimate interests (to develop and improve the Platform), in addition to the licence you grant to us under the Terms.
To process payments (in any paid plan). Lawful basis: performance of a contract with you, and compliance with legal obligations applicable to us (for example, tax and accounting law).
To provide customer and technical support. We use communication and support data to investigate and resolve your queries. Lawful basis: performance of a contract with you and legitimate interests.
To prevent fraud, abuse and unauthorised access. We use device, connection and usage data to detect and investigate suspected unauthorised access, fraud, abuse or other harmful activity. Lawful basis: legitimate interests (to protect the Platform, our users and patients) and compliance with legal obligations.
To comply with legal obligations and protect our legal rights. We may use any personal data we hold to comply with applicable law, respond to lawful requests from competent authorities, defend against legal claims, and enforce the Terms. Lawful basis: compliance with legal obligations and legitimate interests (to protect Limb's legal rights).
We do not use your personal data for marketing or advertising purposes without your separate consent. We do not engage in automated decision-making that has a legal or similarly significant effect on you.
We share your personal data only with the categories of recipient set out below, and only for the purposes set out in clause 5.
Our service providers and sub-processors. We use third party service providers to support the operation of the Platform, including cloud hosting providers, payment processors, customer support providers, email delivery providers, analytics providers and security providers. These providers act on our written instructions and are subject to contractual obligations of confidentiality and security. A list of our sub-processors is available on request.
Your associated Organisation (where applicable). If you are an Authorised User and your Organisation has procured the Platform on your behalf, we may share with the Organisation (typically through the Organisation Administrator) information about your Account and your usage of the Platform that is necessary for the Organisation to administer its licence, manage seats, monitor compliance and operate its clinical service. The Organisation will be a separate controller of any personal data we share with it, and you should refer to the Organisation's own privacy notice for information on how the Organisation handles your personal data. In respect of Patient personal data, the controller is the Individual User or the Organisation (as the case may be); Limb processes Patient personal data only on the controller's documented instructions.
Our professional advisers and auditors. Including our lawyers, accountants and auditors, where reasonably necessary for the proper running of our business and where they are subject to obligations of confidentiality.
Government and regulatory authorities. Where we are required to disclose personal data by applicable law, by a court order, or by a request from a competent authority, or where we consider that disclosure is necessary to investigate, prevent or take action regarding suspected illegal activity, fraud, threats to safety or breaches of the Terms.
In connection with a corporate transaction. Including any merger, acquisition, investment, sale of assets, financing or restructuring. Any successor entity will be bound by terms no less protective of your personal data than those set out in this Privacy Notice.
With your separate consent. Where you have given us your prior, specific consent to a particular disclosure.
We do not sell your personal data. We do not share your personal data with third parties for their own direct marketing purposes.
Limb is established in the United Arab Emirates. Some of our service providers may be located outside the United Arab Emirates. Where we transfer your personal data outside the United Arab Emirates, we do so in accordance with the PDPL, including by using an approved transfer mechanism. Where the destination jurisdiction does not provide an adequate level of protection under the PDPL, we put in place appropriate contractual safeguards with the receiving party.
If you are based in the EU, the UK or another jurisdiction with cross-border transfer rules, we apply additional safeguards as required by the applicable law (including standard contractual clauses or equivalent measures).
We retain your personal data only for as long as is necessary for the purposes for which it was collected, including any retention required by law.
Account and identification data. We keep this data for the duration of your Account, plus a period not exceeding seven years after your Account is closed, for the purpose of defending legal claims and complying with applicable laws (including, where applicable, accounting and tax law).
Usage, device and engagement data. We keep this data in identifiable form for a period of up to twenty-four months. Aggregated and anonymised data derived from it may be retained indefinitely.
Communication and support data. We keep this data for a period of up to twenty-four months after the resolution of the relevant communication.
Payment data. We keep this data for the period required by applicable law (typically not less than five years for tax and accounting purposes).
Bespoke Exercises. Subject to the survival of Limb's licence under clause 7 of the Terms, we retain Bespoke Exercises for the duration of your Account and for a reasonable period thereafter for Platform improvement and AI training, on an anonymised or pseudonymised basis where practicable.
We may retain personal data for longer if required by law or to protect our legal rights.
Under the PDPL, you have the following rights in respect of your personal data:
Right of access. You have the right to ask us for a copy of the personal data we hold about you, and information about how we process it.
Right of correction. You have the right to ask us to correct any personal data we hold about you that is inaccurate, incomplete or out of date.
Right of erasure. You have the right to ask us to delete personal data we hold about you in certain circumstances, including where the personal data is no longer necessary for the purposes for which it was collected.
Right to restriction of processing. You have the right to ask us to restrict the processing of your personal data in certain circumstances.
Right to object to processing. You have the right to object to our processing of your personal data on the basis of our legitimate interests, on grounds relating to your particular situation.
Right to data portability. Where the processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to ask us to transfer your personal data to you or to another organisation in a commonly used machine-readable format.
Right to withdraw consent. Where we rely on your consent to process personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.
Right to lodge a complaint. You have the right to lodge a complaint with the UAE Data Office or with the supervisory authority of your country of residence or place of work.
To exercise any of these rights, contact us at legal@limb.ae. We will respond within thirty days of receipt of a valid request, or within such period as is required by applicable law. We may need to verify your identity before responding. There is no charge for exercising your rights, but we may charge a reasonable administrative fee where a request is manifestly unfounded or excessive.
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access. These measures include:
(a) encryption of personal data in transit (using TLS) and at rest;
(b) role-based access controls and the principle of least privilege;
(c) multi-factor authentication for administrative access;
(d) audit logging and monitoring of system activity;
(e) regular vulnerability scanning and patching;
(f) personnel screening, confidentiality obligations and security training;
(g) a documented incident response plan, including notification of any personal data breach to the controller and (where applicable) to data subjects and authorities, within the timeframes required by the PDPL.
No security measure is perfect. We cannot guarantee absolute security of your personal data. If you become aware of any actual or suspected unauthorised access to or use of your Account, contact us immediately at legal@limb.ae.
The Platform uses a small number of essential cookies and similar technologies to enable the Platform to function, including an authentication token to keep you signed in. We may also use limited analytics technologies to understand how the Platform is used and to improve it. We do not use third party advertising or tracking cookies. Where required by law, we will ask for your consent before using non-essential cookies.
The Platform is intended exclusively for use by licensed healthcare professionals over the age of eighteen. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, contact us at legal@limb.ae and we will take appropriate steps to delete it.
When the Platform is used to design exercise programmes for Patients, the controller of Patient personal data is the Individual User (in the case of an Individual User Account) or the Organisation (in the case of an Organisation Account). Limb acts as processor of Patient personal data in either case. The controller is responsible for obtaining all required consents from Patients, for providing Patients with appropriate information about how their data is processed (including by reference to its own privacy notice), and for ensuring that there is a valid lawful basis under the PDPL (and any other applicable data protection law) for the processing of Patient personal data through the Platform. Limb processes Patient personal data only on the controller's documented instructions, in accordance with the Terms and the Data Processing Terms.
We may update this Privacy Notice from time to time. We will notify you of any material change by email or by a notice within the Platform, with at least thirty days' advance notice where the change adversely affects your rights. The most recent version is always available at https://limb.ae/Privacy.html. The date of the last update is shown at the top of this Privacy Notice.
For any question, request or complaint about this Privacy Notice or about how we process your personal data, contact us at:
Limb Limited VD Building 1B, 3rd Floor, Masdar City, Abu Dhabi, United Arab Emirates. Email: legal@limb.ae.
If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office.