2.1. For the purposes of this Policy, the terms used in the Policy shall be subject to the meaning defined in this section.

2.2. The terms provided for in this section shall be interpreted taking into account the meaning and purpose given by Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data. 45 of 2021 Regarding the Protection of Personal Data, applicable international acts regulating the processing of personal data, and the User Agreement:

• Sensitive Personal Data – any data which directly or indirectly reveals a natural person's family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, or any data relating to such person's health and physical, psychological, mental, genetic or sexual condition, including information related to the provision of healthcare services to him/her which reveals his/her health status.‍
• Biometric Data – Personal Data resulting from processing using a specific technology related to the physical, physiological or behavioral characteristics of the Data Subject, which allows the identification or confirmation of the unique identification of the Data Subject, such as facial images or fingerprints.‍
• Data Subject – a natural person who is the subject of Personal Data. Subject to this Privacy Policy Data Subject includes Client and Operator. 

• Personal Data – any data related to a specific natural person or related to a natural person that can be identified directly or indirectly by linking the data, through the use of identification elements such as his name, voice, image, identification number, his/her electronic identifier, his/her geographical location, or by one or more physical, physiological, economic, cultural or social characteristics. 
• Processing – any operation or set of operations performed on Personal Data using any electronic means, including processing and other means. This processing includes collecting, storing, recording, organizing, adapting, modifying, circulating, altering, retrieving, exchanging, sharing, using, characterizing, disclosing Personal Data by broadcasting, transmitting, distributing, making available, coordinating, merging, restricting, blocking, erasing or destroying it or creating forms thereof.
• Pseudonymization – processing performed on Personal Data in such a way which, after the completion of processing, makes it not possible to associate and attribute such data to the Data Subject without the use of additional information, provided that such additional information is kept independently and securely. In accordance with the technical and organizational measures and procedures specified under provisions of the applicable law, it shall ensure that Personal Data is not linked to a specific natural person or that they can be identified by using it.
• Automated Processing – processing which is carried out using an electronic program or system which operates in an automated and automatic manner either completely independently without any human intervention or partially with limited human supervision and intervention.
• Personal account – personal account in app roboSculptor.
• Robot – roboSculptor massage device.
• Operator Agreement – operator agreement available in the assistant application settings in the "About" tab.
• The Service – massage service with roboSculptor massage device provided for the Client. ‍
• The Service – massage service with roboSculptor massage device provided for the Client. 

The Robotic Therapeutics processes personal data for the following purposes: 

• ensuring the observance of the rights and legitimate interests of personal data subjects as stipulated by UAE legislation, including Regulations, and other relevant legal acts;
• fulfilment by the Robotic Therapeutics of the obligations stipulated by the legislation, within the framework of which it is necessary to carry out the processing of personal data;
• interaction with counterparties (including but not limited to negotiation, preparation and conclusion of contracts, execution of contracts);
• ensuring the functioning of the Robot;
• provision of Robotic Therapeutics to the Client;
• execution of lawful orders of public authorities and officials issued in the manner prescribed by law or by-law, as well as court judgments that have entered into legal force;
• ensuring and protecting the rights and legitimate interests of Robotic Therapeutics;
• other purposes that do not contradict the provisions of the legislation on personal data, in respect of which the personal data subject independently provides voluntary consent to the processing of personal data.

The legal basis for this Policy shall be the following:

• Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data;
• Other normative legal acts that have entered into legal force in the manner prescribed by law and Regulations.

5.1. For the purposes of this Policy, personal data of Data Subjects processed by Robotic Therapeutics means any information directly or indirectly related to the Data Subject’s personal data, including surname, name, patronymic, contact details and other information related to a certain or defined person. 

5.2. Robotic Therapeutics does not process Sensitive Personal Data and Biometric Data. 

5.3. Robotic Therapeutics processes personal data of the following categories of Data Subjects: 

• natural persons who are employees of Robotic Therapeutics (including persons performing their activities on the basis of a civil law contract);
• natural persons who provide professional services of any nature in favor of Robotic Therapeutics;
• natural persons who are Clients;
• natural persons who are members of the management bodies of Robotic Therapeutics;
• natural persons whose personal data are transferred to Robotic Therapeutics in connection with the provision of services or works by Robotic Therapeutics and/or in favor of Robotic Therapeutics;
• natural persons who have given their consent to the processing of their personal data by Robotic Therapeutics;
• natural persons who are Operators;
• other natural persons whose personal data is processed by Robotic Therapeutics in order to fulfil the purposes provided for by the applicable law. 

5.4. Robotic Therapeutics does not carry out cross-border transfer of Personal Data. 

6.1. Robotic Therapeutics stores the Operator's personal data specified in the personal account, including first name, last name and middle name, contact details, provided that the Operator's consent to the storage of their personal data has been obtained.

6.2. Robotic Therapeutics does not transfer the Operator's personal data to other third parties, except in cases expressly provided for by the applicable laws of the UAE.

6.3. Robotic Therapeutics provides the Operator with access to the following personal data of the Client: surname, first name, middle name, height, and weight data. Access to the Client's personal data provided by this Clause is granted to the Operator for the purpose of rendering Service for the Client.

6.4. The Operator represents and warrants that they will ensure the confidentiality and security of the Client's personal data to which the Operator has been granted access.

6.5. The Operator undertakes to settle at its own expense all claims and/or lawsuits of the Clients, state authorities and other persons, brought against Robotic Therapeutics, arising as a result of non-performance and/or improper performance by the Operator of the duties indicated in Clause 6.3 and Clause 6.4 of this Policy, as well as at the request of Robotic Therapeutics within the term specified by them to reimburse any losses arising in connection with such claims and/or lawsuits in the amount specified in the relevant request of Robotic Therapeutics.

6.6. Robotic Therapeutics does not carry out cross-border transfer of personal data of Operators.

7.1. Robotic Therapeutics processes personal data of the Clients specified by them in their consent to provide personal data, including first name, last name and family name, contact details, weight and height information.

7.2. Robotic Therapeutics carries out processing of personal data of Clients by the methods provided in section 10 of this Policy.

7.3. Robotic Therapeutics does not transfer personal data of Clients to third parties without the consent of Clients, except for cases directly provided by the legislation of the UAE. 

7.4. Robotic Therapeutics processes personal data of Clients in accordance with sections 8 and 9 of the Policy.

7.5. Robotic Therapeutics does not carry out cross-border transfer of personal data of Clients.

8.1. In carrying out the processing of personal data, Robotic Therapeutics is guided by the following principles:

• Lawfulness, fairness and transparency. Personal data shall be processed lawfully, fairly and in a transparent manner in relation to individuals.
• Purpose limitation. Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes.
• Data minimization. Personal data processing shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy. Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
• Storage limitation. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organizational measures required by the applicable law in order to safeguard the rights and freedoms of individuals. 
• Integrity and confidentiality (security). Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

8.2. During the processing personal data, Robotic Therapeutics based on the purpose to ensure the protection of the rights and freedoms of personal data subjects, protection of the right to privacy, personal and family secrecy, protection of their honour and good name.

9.1. Robotic Therapeutics processes personal data only under the consent of the Data Subject except for cases, directly provided by the applicable legislation. Robotic Therapeutics does not carry out transfer and/or distribution of personal data without the consent of Data Subject, except for cases stipulated by federal law and/or a legally bound court decision.

9.2. Robotic Therapeutics has the right, under the consent of Data Subject, to entrust the processing of personal data to a third party, provided that such third party guarantees the adoption of measures to ensure the security and confidentiality of personal data, and the level of such measures is not lower than the level provided for in this Policy. Such processing of personal data is carried out solely on the basis of an agreement concluded with Robotic Therapeutics, which explicitly and unambiguously defines the following provisions: 

• list of actions (operations) with personal data to be performed by such third party;
• explicitly and unambiguously defined purposes of personal data processing;
• necessary and sufficient list of legal, technical, and organizational measures that the third party has to take to ensure the security and confidentiality of personal data. In any case, the list of these measures ensures a level of security and confidentiality not lower than that guaranteed by this Policy.

9.3. Robotic Therapeutics takes all necessary and sufficient measures to update the personal data provided to Robotic Therapeutics. In the event Robotic Therapeutics finds inaccurate and/or incomplete personal data, Robotic Therapeutics takes all necessary measures to make appropriate corrections. In case of impossibility of replenishment and/or correction of incomplete and/or inaccurate data, Robotic Therapeutics terminates (destroys if such personal data is not stored on removable media) such personal data, including all copies of such data available to Robotic Therapeutics. 

9.4. Robotic Therapeutics guarantees inadmissibility of association of personal data of different volume and/or having different purposes of processing and/or personal data of different categories of Data Subject.

9.5. Access to the personal data of Data Subject is provided to the employees of Robotic Therapeutics exclusively for the purpose of fulfilling their labor duties to the extent necessary for the performance of their respective labor duties (personal data are not provided in an exhaustive scope).

9.6. Robotic Therapeutics takes a set of organizational, technical, legal measures aimed at ensuring security, maintaining confidentiality, inadmissibility of unauthorized access by third parties, ensuring the use of personal data strictly in accordance with the purposes of providing such personal data and subject to this Policy and applicable law. Robotic Therapeutics on a permanent basis carries out assessment of the impact of personal data protection.

9.7. Robotic Therapeutics processes personal data until fulfilment of the purpose for which the personal data was obtained. 

Robotic Therapeutics processes personal data in the following ways:

• automated processing of personal data;
• non-automated processing of personal data;
• mixed processing of personal data.

11.1. During the processing personal data, Robotic Therapeutics shall:

• apply the appropriate technical and organizational procedures and measures to protect Personal Data at the design stage, whether during the identification of the means of processing or during the processing, considering the cost of implementing such procedures and the nature, scope and purposes of processing.
• carry out the processing according to the purpose and the period specified for it. If the processing exceeds the specified period, Robotic Therapeutics shall notify the Data Subject to receive consent to extend processing period;
• erase data after the expiry of the processing period;
• avoid doing anything which would disclose Personal Data or results of processing, except in cases authorized by applicable law;
• protect and secure data processing, including the electronic media and devices used in processing and the Personal Data they contain;
• maintain a special record of Personal Data which is processed;
• carry out processing in accordance with rules, conditions and controls specified in applicable law and Regulations;
• appoint a data protection officer;
• report Personal Data Breach.

11.2. Data Subject may:

• in the manner and within the timeframes provided for by applicable law and this Policy, to receive, upon request, information regarding the processing of personal data;
• send requests and information on clarification and/or changes of their personal data to the e-mail address support@robo-sculptor.com;
• request to receive and/or transfer the provided personal data as instructed;
• request the termination and/or destruction of their personal data;
• request to restrict the processing of the personal data provided;
• file complaints about the actions/inactions of Robotic Therapeutics and/or third parties processing personal data on behalf of Robotic Therapeutics;
• withdraw their consent to the processing of personal data; 
• take other measures to protect its legitimate interests in accordance with the provisions of applicable law.

12.1. In order to fulfil the provisions of this Policy, the requirements of UAE legislation, Robotic Therapeutics shall take all necessary and sufficient measures to ensure the fulfilment of the duties of the personal data controller. These measures include the following:

• appointment of a person responsible for the organization of personal data processing (data protection officer);
• encryption of Personal Data and the application of Pseudonymization;
• applying measures which ensure the continued confidentiality, safety, accuracy and flexibility of data processing systems and services;
• applying measures which ensure a seamless testing and evaluation of the effectiveness of the technical and regulatory measures to ensure the security of processing;
• applying measures which ensure timely retrieval of and access to Personal Data in case of any actual or technical failure;
• organizing training of Robotic Therapeutics' employees in order to ensure their compliance with the applicable personal data legislation, as well as conducting training events aimed at the general improvement of the employees' legal culture when handling personal data;
• ensuring separate storage of personal data processed for different purposes and/or containing different categories of personal data;
• ensuring separate storage of personal data processed in different ways;
• prohibition of personal data transmission via open communication channels without taking necessary and sufficient security measures;
• exercising internal control over the processes of personal data processing; 
• ensuring that the consent of Data Subject to the processing of personal data is obtained;
• timely response to requests, notifications and claims of Data Subject sent to the Robotic Therapeutics;
• other measures provided by applicable law.

13.1. In the event Robotic Therapeutics receives a request from a Data Subject to provide information and/or perform certain actions, Robotic Therapeutics, based on the provisions of applicable legislation in the field of personal data and the provisions of this Policy, provides the Data Subject with the necessary information in full or in part and/or performs the corresponding actions, or refuses to provide such information in full or in part and/or perform such actions and sends within 72 (seventy two) hours from the date of the request to Robotic Therapeutics to provide information and/or perform certain actions.

13.2. In the event Robotic Therapeutics receives from a Data Subject a complaint about the actions/inaction of Robotic Therapeutics, Robotic Therapeutics, based on the provisions of applicable legislation in the field of personal data and the provisions of this Policy, immediately takes measures to prevent further violation of the rights of the based on the provisions of applicable legislation in the field of personal data and the provisions of this Policy, and mitigate the consequences of the violation of rights and within 72 (seventy two) hours from the date of receipt of the complaint sends information about the measures taken by  Robotic Therapeutics. If Robotic Therapeutics comes to the conclusion that the complaint of the Data Subject fully or in part does not meet the requirements of the applicable law, Robotic Therapeutics within 72 (seventy two) hours from the date of receipt of the complaint sends a detailed response indicating the reasons why such complaint is not accepted by Robotic Therapeutics in whole or in part. 

14.1. For the purposes provided by this Policy, Robotic Therapeutics carries out independent processing and collection of cookies for marketing purposes.

14.2. Robotic Therapeutics collects and processes the following types of cookies:

• Strictly necessary cookies / Technical cookies;
• Statistical / Analytical Cookies;
• Functional Cookies;
• Tracking files (third party files) / Advertising cookies.

14.3. Cookies are collected and processed in accordance with the terms and conditions stipulated in the Cookie Policy, the current version of which can be found at: https://www.robo-sculptor.com/privacy-policy

15.1. Robotic Therapeutics and Robotic Therapeutics' officials are responsible under UAE law for compliance with the provisions of this Policy and the requirements of applicable law.

15.2. For the purposes of this Policy, the official address for correspondence and communication, including for complaints and enquiries, is: Unit 44, Ground Floor, Costra Business Park (Block G), Dubai Production City, Dubai, United Arab Emirates.

15.3. Robotic Therapeutics has the right to make changes in the present Policy. Robotic Therapeutics is obliged to notify subjects of personal data about modification of the present Policy not later than 5 (five) working days before the new edition of the present Policy comes into force. The actual edition of the present Policy is placed at the address: https://www.robo-sculptor.com/privacy-policy.