Privacy policy

Who we are

DrWellNext is run by TBD · LEGAL COMPANY NAME, a Delaware C-Corp registered in the US. Registered address: TBD · REGISTERED ADDRESS. We operate from the UAE. DrWellNext was founded by Dr. Nadeem Ahmed Noorbasha, a doctor.

We decide how and why your data is used, so we are responsible for it. Depending on where you live, the law calls us the “controller” (UAE, EU and UK), the “data fiduciary” (India) or the “business” (California).

We have no office in the EU or the UK. Our representative there: EU TBD · EU REPRESENTATIVE and UK TBD · UK REPRESENTATIVE. You can also always write to us directly.

What this policy covers

This policy covers drwellnext.com, our early-access waitlist, our contact form and the emails we send. The DrWellNext app is not live yet. “Login” on the site only shows a “coming soon” message, and there are no accounts.

What we collect

When you join the waitlist

• Your email address.
• The date and time you signed up.
• Where you came from: the campaign tags in the link you used (utm_source, utm_medium, utm_campaign), if it had any, and the domain of the website that sent you, if your browser shares it.

When you contact us

• Your name, email address and message.
• The date and time, and the page you sent it from.

When you visit

• Our host, Vercel, keeps standard logs: IP address, browser and device type (user agent) and timestamps. These keep the site secure and working.

What we don’t collect

• No health data. Please don’t include health details in a message. We don’t need them to reply.
• No cookies, analytics, advertising trackers or third-party embeds. Our fonts are hosted on our own site, so visiting does not contact Google or any other font service.
• Our LinkedIn and Instagram links are plain links. Those sites only see your visit if you click them, and then their own privacy policies apply.

You don’t have to give us anything to browse the site. We need your email to add you to the waitlist, and your name, email and message to reply to you.

How we use it, and why we are allowed to

• Waitlist emails about early access and product updates. Basis: your consent, which you give when you join. You can withdraw it at any time.
• Knowing where signups come from (campaign tags and referring site), so we know which channels work. Basis: our legitimate interest in running the waitlist well.
• Replying to your enquiry, including one automatic email confirming we received it. Basis: our legitimate interest in answering people who write to us.
• Keeping the site secure and working (hosting logs). Basis: our legitimate interest in security and reliability.
• Meeting legal duties, such as answering a valid request from a regulator. Basis: legal obligation.

We don’t use your data for advertising, profiling or decisions made automatically about you.

Our emails

When you join the waitlist or send us a message, we send you one email confirming it. Apart from that, we only email waitlist members about early access and product updates, and we never add people who only sent a message to the waitlist. Every email says who it is from, and every update email has an unsubscribe link. Unsubscribing takes one click, just as easy as signing up. We act on it straight away, and always within 10 business days.

After you unsubscribe, we may keep a short record of your email address so we don’t email you again by mistake.

Who helps us

• Loops (loops.so) — stores the waitlist and sends our early-access and update emails.
• Resend (resend.com) — sends the one confirmation email when you join the waitlist or send us a message.
• Airtable — the database where our team views and sorts waitlist signups and enquiries.
• Vercel — hosts this website and keeps the hosting logs.

They act only on our instructions, under data-processing terms, and may process data in the United States. We add any new provider to this list the same day we start using it.

We never sell your data or share it for advertising. We only disclose it otherwise if the law requires it, to protect someone’s safety or our legal rights, or if DrWellNext is reorganised or sold. In that case this policy still applies to your data.

Data going abroad

We operate from the UAE and our providers may process data in the United States, so your data may leave your country. We protect it like this:

• EU and UK: where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension), we may rely on that. Otherwise we use the EU Standard Contractual Clauses, with the UK Addendum or the UK International Data Transfer Agreement.
• UAE: we transfer data only in the ways the UAE data protection law allows, such as under contracts that keep it protected.
• India: we never transfer data to a country the Government of India has restricted.

Email us for a copy of the safeguards we use.

How long we keep it

• Your waitlist email, signup date and where you came from: until you unsubscribe, ask us to delete it, or we close the waitlist.
• Enquiries: as long as we need to deal with your message, and no longer than 24 months after our last reply.
• Hosting logs: up to 30 days.
• An unsubscribe record: only as long as we need it to respect your choice.

If a law makes us keep something longer, we keep only what it requires, for only as long as it requires.

Security

Data is encrypted in transit and at rest, and only a small number of team members can access it. If a breach affects your data, we will tell you and the relevant regulators whenever the law requires it.

Your rights

Wherever you live, you can ask us to:

• Tell you what data we hold about you, and give you a copy.
• Correct it or complete it.
• Delete it.
• Give it to you in a format you can take elsewhere.
• Stop or limit using it, or object to how we use it.
• Withdraw your consent. This is as easy as giving it, and it doesn’t affect what we did before.

You can also complain to us, and to a data protection regulator. See your rights by region below.

How to ask

• Email team@drwellnext.com. It is free.
• To protect you, we may ask you to confirm the request from the email address you gave us. We only ask for what we need to check it is you, and use it only for that.
• Someone else can ask for you, such as an authorised agent, if they show us your written permission. We may also check with you directly.

How fast we reply

We reply within 30 days (within one month in the EU and the UK). If a law sets a shorter deadline, we meet it. If a request is complex and the law allows more time, we will tell you within those 30 days, and say why.

Your rights by region

UAE

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) you can:

• Get information about, and access to, your data.
• Ask us to transfer it to you or to another organisation.
• Correct, delete or restrict it, or ask us to stop using it.
• Object to decisions made only by automated means. We make none.
• Withdraw your consent at any time.

If you are not happy with our answer, you can complain to the UAE Data Office. The separate data protection laws of the DIFC and ADGM free zones do not apply to us, because we do not operate there.

India

India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are coming into force in stages. We already follow them.

• Notice: this page is our notice to you. You can ask for it in English or in any language listed in the Eighth Schedule to the Constitution of India.
• Consent: we ask for it clearly when you join the waitlist. Withdrawing it is as easy as giving it: one click on unsubscribe, or one email. For enquiries, we use only what you choose to send us, to reply to you.
• Your rights: a summary of the data we hold, what we do with it and who we have shared it with; correction, completion, updating and erasure; grievance redressal; and the right to nominate someone to use your rights if you die or are unable to.
• Grievances: write to team@drwellnext.com, our contact for questions and grievances. We aim to resolve them within 30 days, and always within the 90 days the Rules allow. If you are not satisfied after using this process, you can complain to the Data Protection Board of India.
• Children: in India, anyone under 18 is a child. Our site is not for them.

EU and UK

Under the EU GDPR, and in the UK the UK GDPR and the Data Protection Act 2018:

• Lawful bases: consent for waitlist emails; legitimate interests for enquiries, signup sources and security logs; legal obligation where it applies. See how we use it.
• Marketing emails: we only send them with your consent, as e-privacy rules require (in the UK, the Privacy and Electronic Communications Regulations).
• Your rights: access, correction, erasure, restriction, portability, objection, withdrawing consent, and not being subject to decisions made only by automated means.
• Objecting: where we rely on legitimate interests, you can object and we will stop, unless we have compelling reasons to continue, such as investigating a security incident.
• Transfers: see data going abroad.
• Complaints: you can complain to the data protection authority where you live or work in the EU, or in the UK to the Information Commissioner’s Office (ico.org.uk). We would welcome the chance to put things right first.

United States

California. Where the California Consumer Privacy Act (as amended by the CPRA) applies to us:

• What we collected in the last 12 months: identifiers (name, email address, IP address); internet activity (browser type, timestamps, referring site, campaign tags, the page an enquiry came from); and anything you choose to write in a message. We do not collect sensitive personal information.
• Sources: you, and your browser or device.
• Purposes: as set out in how we use it. We disclose data for business purposes only to our service providers: Loops, Resend, Airtable and Vercel.
• We do not sell or share personal information, including for cross-context behavioural advertising, and have not done so in the last 12 months. We also honour Global Privacy Control signals as an opt-out request.
• Your rights: to know and access what we hold; to delete it; to correct it; to opt out of sale or sharing; to limit use of sensitive personal information (we hold none); and not to be treated differently for using any of these rights.
• Requests: email us. We confirm receipt within 10 business days and reply within 30 days. We verify requests by matching them to the email address you gave us. An authorised agent can ask for you with your signed permission, and we may ask you to confirm it directly.

Other US states. If you live in another state with a privacy law, such as Colorado, Connecticut, Virginia, Texas or Oregon, you have similar rights and we honour them in the same way. If we turn down your request, you can appeal by replying to our answer. If you are still unhappy, you can contact your state attorney general.

Emails. In line with the CAN-SPAM Act, our emails say who they are from, have honest subject lines, include our postal address, and have an unsubscribe link that we honour within 10 business days.

Children. Our site is not directed to children. In line with the Children’s Online Privacy Protection Act, we do not knowingly collect data from children under 13, and our minimum age is 18.

Under 18s

This site is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has given us their data, email us and we will delete it.

Changes

If anything important changes, we will email everyone on the waitlist — not just update the date above.

Contact

Questions, requests and grievances, from any country: team@drwellnext.com.

By post: TBD · LEGAL COMPANY NAME, TBD · REGISTERED ADDRESS.