Aden Bio L.L.C-FZ
Effective date: 23 September 2026
Introduction
Aden Bio L.L.C-FZ ("Aden", "we", "our", "us") operates aden.health and the Aden membership platform (together, the "Services"). This policy explains what personal data we collect about you, why we process it, who receives it, how long we keep it, and what rights you have.
We act as data controller for the processing described here, except where stated otherwise.
Who we are
Aden Bio L.L.C-FZ
Meydan Grandstand, 6th Floor
Meydan Road, Nad Al Sheba
Dubai, United Arab Emirates
Licence number: 2647783.01
Email: hello@aden.health
Aden Bio L.L.C-FZ is the controller of your personal data and the entity you contract with. It is a wholly owned subsidiary of Aden Bio Limited, a company registered in Ireland under number 799563, with its registered office in County Galway, Ireland. Where personal data is shared within the group, it is shared under an intragroup data processing agreement and subject to the transfer safeguards described in section 9.
We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), Federal Law No. 2 of 2019 on the Use of Information and Communications Technology in Health Fields, and, where it applies, the General Data Protection Regulation.
What Aden is, and what it is not
Aden is a wellness and analytics platform. We read biomarker results and other health inputs, score them, and produce personalised information and recommendations.
Aden is not a laboratory, a clinic, or a medical provider. We do not diagnose, treat, or provide medical advice. Laboratory testing and any clinical services are provided by licensed third parties. Where a result warrants medical attention, we direct you to a doctor.
This affects who holds what. Your laboratory results are generated by our partner laboratory, which is a controller in its own right and retains those records under its own licensing obligations. We receive them in order to provide the membership you have subscribed to.
The data we collect
a) Identification and contact details
Account information. First name, last name, email address, phone number, date of birth, sex at birth, country of residence, password, referral code where you joined through one, and your Emirates ID or passport number where the Laboratory requires it for sample collection.
Profile information. Height, weight, menstrual cycle where applicable, lifestyle inputs such as sleep and meal timing, health goals, personal and family health history.
Communications. Messages, emails and voice notes you send our support team, and the date and time of those exchanges.
b) Health data
Health status. Biomarker results, symptoms, conditions, medications and supplements, medical and family history, and how these change over time.
Test results. Results returned by our partner laboratory, and any results or documents you upload yourself.
Data Aden generates about you. Biomarker scores against personalised reference ranges, body system scores, risk indicators, your Health Story, and the recommendations produced from them. This is data we create rather than data you give us, and it is health data in its own right.
Wearable data. Where you connect a device, the metrics it shares with us, which may include sleep, heart rate and activity.
c) Payment and transactional data
Subscription status, billing history, the identifier assigned to you by our payment provider, and the last four digits of your card. Full card details are collected and held by the payment provider and never reach our systems.
d) Referral data
Where you refer someone or join through a referral, we record the code used, who issued it, whether the referred person went on to subscribe, and any credit applied.
e) Marketing data
Your contact details, your choices about receiving marketing, the origin of your enquiry, and a record of exchanges with our team.
f) Technical and usage data
Device type, device identifiers, operating system, browser, IP address, pages visited, referring and exit pages, features used, session duration, general usage patterns, and the dates and times of your visits.
g) Cookies
Set out in section 12.
How we use your data
For each purpose we state the legal basis and how long we keep the data.
Creating and managing your account
Legal basis: Performance of contract
Retention: Duration of your membership, plus 24 months
Arranging blood tests and home collection visits
Legal basis: Performance of contract
Retention: Duration of your membership, plus 24 months
Analysing your biomarkers and generating scores, Health Story and recommendations
Legal basis: Explicit consent for health data; performance of contract
Retention: Duration of your membership, plus 24 months, or until you withdraw consent
Sharing your details with our partner laboratory
Legal basis: Explicit consent for health data; performance of contract
Retention: Duration of your membership, plus 24 months
Processing payments and managing billing
Legal basis: Performance of contract; legal obligation
Retention: 5 years after the end of the contractual relationship, for accounting and tax purposes
Operating the referral programme
Legal basis: Performance of contract; legitimate interests
Retention: 24 months from the date the credit was issued or expired
Customer support and service communications
Legal basis: Performance of contract
Retention: Duration of your membership, plus 24 months
Marketing communications about Aden
Legal basis: Consent; legitimate interests where you are an existing member
Retention: Until you withdraw consent or object, or 3 years from your last contact with us
Improving our scoring models, ranges and product
Legal basis: Legitimate interests, using aggregated or de-identified data only; explicit consent where identifiable health data is used
Retention: Aggregated and de-identified data may be retained indefinitely
Platform security, fraud prevention and abuse monitoring
Legal basis: Legitimate interests; legal obligation
Retention: 24 months
Understanding how the platform is used and improving it
Legal basis: Legitimate interests; consent for analytics cookies
Retention: 24 months
Handling complaints, claims and disputes
Legal basis: Legitimate interests; legal obligation
Retention: Duration of the matter, plus the applicable limitation period
Responding to data subject rights requests
Legal basis: Legal obligation
Retention: Duration of the request, plus 5 years
Managing a merger, acquisition, investment or other corporate transaction
Legal basis: Legitimate interests in the development of our business
Retention: Duration of the transaction, plus applicable legal requirements
Where retention periods differ, the longest applicable period governs. At the end of a retention period, data is deleted or irreversibly de-identified.
Health data and consent
Health data is a special category of personal data and receives additional protection. We process it on the basis of your explicit consent, which you give when you subscribe.
You may withdraw that consent at any time by emailing hello@aden.health. Withdrawing it means we can no longer analyse your biomarkers or provide the membership, and we will close your account and refund the unused portion in accordance with our Terms and Conditions.
Your health data is never used for marketing or advertising, never shared with analytics, advertising or email providers, and never sold, rented or licensed.
Automated processing
Aden's scoring and recommendations are produced by automated analysis of the data you provide.
We do not make decisions about you by solely automated means that produce legal consequences or that seriously affect you. What Aden produces is information for you to consider and to discuss with a doctor. It is not a decision taken about you, it does not determine your access to any service, and it is not shared with insurers, employers or any party who could act on it.
You have the right to ask us to explain how a score or recommendation was produced, and to object to automated processing.
Who receives your data
Our partner laboratory, to arrange your test, collect your sample and return your results. It holds the diagnostic licensing, its nurses operate under its home healthcare authorisation, and it acts as a controller in its own right.
Reviewing clinicians. Licensed physicians review the Aden scoring model and its logic for scientific consistency. They do not review individual results and do not receive your personal data.
Our processors, being cloud hosting, database, email delivery, analytics, PCI DSS compliant payment processing and wearable data aggregation providers.
Aden personnel, on a need-to-know basis and subject to access logging.
Public and judicial authorities, where required by law, court order, or a competent regulatory authority.
A potential acquirer or investor, in connection with a merger, acquisition or financing, subject to confidentiality undertakings. Where health data is involved it is disclosed in de-identified form unless the transaction completes and the acquirer assumes our obligations under this policy.
Corporate and venue partners. If your membership is sponsored by an employer, gym, club or other organisation, that organisation never sees your individual results. Partners receive only aggregated, de-identified reporting where the cohort is large enough that no individual can be identified.
We never sell your personal data, and we do not share it with advertisers, insurers, employers or data brokers.
Where your data is held
Your personal data, including all health data, is stored in the United Arab Emirates on Microsoft Azure's UAE North region in Dubai. Health data is not transferred outside the UAE.
Some of our processors, including our email, analytics and payment providers, handle contact, usage and payment data outside the UAE. Where they do, the transfer is made only to a jurisdiction offering an adequate level of protection, or under appropriate safeguards including standard contractual clauses, and never includes health data.
Security
Your data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256.
Our main measures are:
Network isolation, with databases held in private subnets not reachable from the public internet
Access granted on the principle of least privilege, reviewed periodically, with multi-factor authentication required for all administrative access
Access to health data logged and auditable
Automated daily backups, with defined recovery point and recovery time objectives, and recovery tested periodically
Security training for all personnel with access to personal data
Contractual security obligations on every processor
No system is completely secure. Where a breach is likely to prejudice your privacy, confidentiality or the security of your data, we will notify the UAE Data Office and, where the risk to you requires it, notify you directly, without undue delay.
Your rights
You have the right to:
Access the personal data we hold about you, and to receive a copy
Correct data that is inaccurate or incomplete
Delete your data, subject to the retention exceptions above
Restrict processing, or object to processing based on our legitimate interests
Portability, receiving your data in a structured, commonly used, machine-readable format
Object to automated processing, and to ask how a score or recommendation was produced
Withdraw consent at any time, including consent to process health data
Object to direct marketing at any time
Complain to the UAE Data Office, or to the supervisory authority in your country of residence
To exercise any of these, email hello@aden.health. We acknowledge requests within 5 business days and respond within 30 days. Because health data is involved, we may ask you to verify your identity first.
Cookies
We use three types of cookies. Strictly necessary cookies keep the site and platform working, including sign-in and security, and cannot be switched off. Analytics cookies help us understand how the site is used. Marketing cookies, including the Meta Pixel, measure the performance of our advertising.
Analytics and marketing cookies are set only with your consent, given through the banner on your first visit and changeable at any time. We never use cookies to collect or transmit health data.
Records of your cookie choices are kept for 12 months.
Communications and marketing
We send service messages that are needed to provide your membership, including booking confirmations, result notifications, renewal reminders and account notices. We send these by email and in-app notification, and by SMS or WhatsApp where you have given us a mobile number. Service messages continue while your account is active.
We send marketing messages only where you have opted in. You can opt out at any time through the unsubscribe link in any marketing email, by replying STOP to an SMS, or by emailing hello@aden.health. Opting out of marketing does not stop service messages.
Third-party links and connected services
The Services may link to third-party websites and let you connect third-party devices and apps, such as wearables. This policy does not cover how those third parties handle your data. We recommend reading their privacy policies before connecting them or sharing data with them.
Children
Aden is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, contact hello@aden.health and we will delete it.
Changes to this policy
We may update this policy to reflect changes in law or in how we process data. Where a change materially affects your rights, we will notify you by email before it takes effect. The effective date at the top shows when this version was published.
Contact
Data protection questions, rights requests, complaints and general enquiries: hello@aden.health
Aden Bio L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates