Clinic conversations should stay useful, protected, and accountable.

1. Scope and roles

ERA Global Solutions FZ-LLC (“ERA”, “Flowra”, “we”, or “us”) is a Free Zone Limited Liability Company licensed by Ras Al Khaimah Economic Zone (RAKEZ) in the United Arab Emirates and is the owner and operator of Flowra.

Flowra is a clinic operations product for booking, appointment reminders, patient conversations, rescheduling, and reception-controlled waitlist work. This notice applies to clinic team members, patients who communicate with a participating clinic, product reviewers, and people who contact ERA about Flowra.

A participating clinic normally decides why and how its patient information is used and acts as controller of those patient records. ERA normally processes that information for the clinic under its documented instructions. ERA acts as controller for information it determines how to use for account administration, security, support, billing, legal compliance, and service governance.

UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data applies where its territorial and material rules are met. A clinic and patient may also be protected by the laws of the country or healthcare jurisdiction where the clinic operates.

2. Information we process

Clinic and team information

• Clinic name, contact information, workspace settings, locations, services, and working hours.
• Authorized team member names, work email addresses, roles, access events, and support requests.

Patient and appointment information

• Patient name, phone number, appointment details, preferred times, and booking source.
• WhatsApp message content, reminder responses, conversation history, delivery/read status, and rescheduling or waitlist choices.
• Operational notes entered by an authorized clinic team member.

Health-data boundary: Flowra’s current appointment-operations scope is not an electronic medical record. Clinics should not enter diagnoses, clinical notes, medical images, laboratory results, or other detailed health records unless ERA has expressly approved the workflow, data residency, contract, and health-authority requirements.

Meta and WhatsApp connection information

ERA processes information only where a permitted legal basis applies, including valid consent where required, performance of an agreement or requested service, compliance with law, protection of rights or safety, and other grounds available under applicable law.

• Business portfolio, WhatsApp Business Account, business phone number, phone number ID, and message-template metadata.
• Short-lived authorization codes, business access tokens, webhook events, and connection status needed to operate the clinic’s integration.

Security boundary: Meta app secrets and business access tokens are processed server-to-server and are not placed in the browser. Tokens are stored in the deployment’s protected secrets store.

3. How we use information

• Provide booking, reminders, clinic inbox, appointment response, and waitlist workflows.
• Send and receive clinic-authorized WhatsApp messages and manage approved message templates.
• Connect and maintain clinic-owned WhatsApp Business assets through Meta Embedded Signup.
• Protect accounts, diagnose delivery problems, prevent abuse, and maintain audit records.
• Respond to support, privacy, security, and data-deletion requests.
• Measure service reliability using aggregated operational information where practical.

Flowra does not sell patient information. Flowra does not use patient conversations to build advertising profiles.

Utility and marketing messages

Appointment confirmations, requested rescheduling, service messages, and reminders connected to an existing booking are configured as utility communications. Clinics must not convert these templates into promotions.

Promotional WhatsApp or social-media messages require a separate lawful campaign. For UAE recipients, the clinic and ERA must satisfy applicable consent or consumer-request requirements, identify the sender and purpose, honor opt-outs and the Do Not Connect Registry where applicable, use an appropriately licensed company number, observe permitted contact times, and meet any approval or record-keeping requirements imposed by the competent authority.

4. When information is shared

Information is available to authorized users of the clinic workspace and to the service providers below, which help ERA operate Flowra under contractual and security obligations. ERA does not sell information and does not share it for unrelated advertising.

Service providers

• Meta Platforms — WhatsApp Business Platform message delivery, business asset connection, and message templates.
• Supabase — managed database, authentication, and protected secret storage for clinic workspaces, in Germany.
• Hostinger — application hosting for the Flowra service, in Germany.
• Cloudflare — domain routing, content delivery, and traffic protection.
• Backblaze — encrypted backup storage.

Self-operated components: ERA runs its workflow automation and deployment tooling on its own hosting described above. Those components are operated by ERA and are not separate third-party recipients of clinic or patient information.

ERA maintains the current processing region for each provider and will supply it to a participating clinic on request. ERA will update this notice before adding a provider that processes clinic or patient information.

ERA may disclose information when required by applicable law, to protect rights and safety, or as part of a business transaction subject to appropriate confidentiality and notice.

5. Retention and deletion

Flowra retains information only for as long as it is needed to provide the clinic service, satisfy a documented clinic instruction, protect the service, or meet a legal obligation.

Default retention periods

These are maximum periods. ERA may delete sooner, and a signed clinic agreement or a mandatory legal requirement may set a different period.

• WhatsApp messages and conversation history — 24 months from the date of the message.
• Appointment and booking records — 5 years from the appointment date.
• Clinic account, workspace, and access records — 12 months after the workspace is closed.
• Technical, delivery, and security logs — 90 days.
• Encrypted backups — 35 days on a rolling cycle.
• Marketing consent records, where a clinic runs a promotional campaign — 3 years from the last message sent, as required by Egyptian law.

Where a healthcare, tax, or other legal retention rule requires a longer period for a specific record, ERA restricts that record to the required purpose for the remainder of the period.

When a clinic disconnects WhatsApp, Flowra revokes or deletes connection credentials that are no longer needed. A disconnect does not automatically delete patient records that the clinic must retain. Clinic-authorized deletion and individual deletion requests are handled through the process in our data deletion instructions.

6. Your choices

Subject to identity verification, applicable exceptions, and the clinic/ERA controller roles, you may ask to obtain information about processing, access or transfer information, correct inaccurate information, erase information, restrict or stop processing, object to direct marketing, withdraw consent where processing depends on consent, or challenge a decision based solely on automated processing.

Patients should normally contact their clinic first because the clinic controls the patient record. You may also contact ERA and we will route a verified request to the appropriate clinic where necessary.

You can stop promotional WhatsApp messages at any time by telling the clinic or using the available opt-out. You may also object to direct marketing under the UAE Personal Data Protection Law. Essential, requested appointment communication may move to another channel selected by the clinic.

7. Security and international processing

ERA uses access controls, clinic workspace separation, encrypted transport, protected secret storage, operational logging, and least-privilege integration permissions. No online service can promise absolute security, so ERA also maintains incident investigation, credential-revocation, backup, and breach-assessment procedures. ERA will notify the competent authority and affected people when applicable law requires it.

Where information is processed

ERA is established in the United Arab Emirates. The Flowra application, its database, and its authentication and secret storage are hosted in Germany. Meta processes WhatsApp messages on its own global infrastructure under its terms, and backup and content-delivery providers may process information in their own regions. This means information collected in a clinic’s country, including Egypt and the UAE, is processed outside that country.

ERA applies the UAE cross-border transfer requirements, the Egyptian cross-border transfer requirements described below, and any additional clinic-jurisdiction safeguards before enabling those transfers. ERA will confirm the applicable transfer basis with a clinic before onboarding it.

For UAE healthcare customers, Federal Law No. 2 of 2019 concerning the use of information and communication technology in health fields and the requirements of the relevant UAE health authority may apply, including confidentiality, integrity, availability, access, storage, and transfer controls. ERA must confirm the hosting region and required health-authority approvals before onboarding a UAE clinic that will process regulated health data.

8. Automated decisions and children

Flowra’s current v1 does not make solely automated decisions that produce legal or similarly significant effects for patients. Appointment-response and waitlist actions remain under clinic-team control. If this changes, ERA will document the logic, safeguards, and available human review before deployment.

Flowra is provided to clinics and authorized business users, not directly to children. Clinics are responsible for obtaining parent or guardian authority where a minor’s appointment information is processed and applicable law requires it.

9. Legal framework: United Arab Emirates

This notice is designed around the UAE Personal Data Protection Law, the UAE law governing ICT in health fields, and the 2024 UAE Telemarketing Regulations. Sector, free-zone, emirate, healthcare, consumer, and recipient-country rules may also apply.

People may contact ERA first to exercise a right or raise a concern. Where available and applicable, a person may also submit a complaint to the UAE Data Office or another competent supervisory or health authority.

10. Legal framework: Egypt

Where a participating clinic operates in Egypt, or where patients in Egypt communicate with a participating clinic through Flowra, Egyptian Law No. 151 of 2020 on the Protection of Personal Data applies to that processing. ERA’s establishment in the United Arab Emirates does not remove that protection.

Under that law the clinic normally acts as controller of its patient records and ERA normally acts as processor under the clinic’s documented instructions, mirroring the roles described in section 1.

Sensitive personal data

Egyptian law treats data revealing physical or mental health as sensitive personal data, and treats all children’s data as sensitive. Collecting, storing, transferring, or processing sensitive personal data requires a licence from the Egyptian Personal Data Protection Center and, except where the law expressly permits otherwise, written and explicit consent from the person concerned. Consent for a child must come from a parent or legal guardian.

This is why the health-data boundary in section 2 matters. Flowra’s appointment-operations scope is deliberately limited so that clinics do not place diagnoses, clinical notes, medical images, or laboratory results into Flowra. ERA must confirm the applicable Egyptian licence position with a clinic before that clinic processes regulated health data through Flowra.

Transfers outside Egypt

Egyptian law restricts transferring, storing, or sharing personal data outside Egypt unless the destination provides protection not less than Egyptian law and the transfer is licensed or authorised by the Center. The law also allows specified transfers where the person has given explicit consent, including transfers necessary to provide medical care or to manage a person’s healthcare services, and transfers necessary to perform a contract concluded for the benefit of the person.

As described in section 7, Flowra is hosted in Germany and Meta processes WhatsApp messages on its own infrastructure. ERA documents the applicable transfer basis with each Egyptian clinic before onboarding and will not onboard an Egyptian clinic without confirming that basis.

Direct marketing to people in Egypt

Appointment confirmations, reminders tied to an existing booking, requested rescheduling, and necessary service messages are utility communications, not direct marketing. Promotional electronic messages to people in Egypt require prior consent, clear identification of the sender, a valid and accessible sender address, an explicit statement that the message is for marketing, and an easy way to opt out or withdraw consent. The sender must not disclose a recipient’s contact details and must keep records of consent for three years from the last message sent.

Rights and complaints

People in Egypt may exercise the rights described in section 6. A person may contact ERA or the participating clinic first, and may also complain to the Egyptian Personal Data Protection Center or another competent authority.

Status: ERA continues to work through the registration, licensing, and data protection officer requirements that apply to its Egyptian operations, including those that depend on the Executive Regulations of Law No. 151 of 2020. ERA will update this notice as that position is confirmed. This notice describes ERA’s handling of information and is not a statement that every Egyptian registration is already in place.

11. Contact and updates

ERA may update this notice when Flowra, its suppliers, or legal requirements change. Material changes will be shown by a new effective date and communicated to participating clinics where appropriate.