Amal.care is operated by Amal Care Ltd. ("Amal.care," "we," "our," or "us"). We are committed to safeguarding the privacy and dignity of every individual who interacts with our platform. This Privacy Policy sets out how we collect, process, store, and protect personal information in connection with our AI-powered student wellness platform, including our institutional administrator portal, our web-based platform, and any related services (together, the "Services").
This Policy applies to university administrators, institutional procurement contacts, and — where applicable — students accessing the Services through their enrolled institution. If you are a student, your institution acts as the primary data controller and you should also consult your institution's own privacy notices.
By accessing or using the Services, you confirm that you have read and understood this Policy. If you do not agree with its terms, please discontinue use of the Services immediately.
Who We Are and How to Reach Us
Amal Care Ltd. is the data controller responsible for personal information processed through the Services. We operate exclusively within the MENA region and maintain all data within GCC-compliant infrastructure.
We take privacy seriously at every level of our organisation. Our data handling practices are designed to comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL-KSA), and applicable GCC data residency requirements.
Information We Collect
2.1 Information Provided by Institutions
When a university or academic institution engages with Amal.care — including through our pilot programme or formal deployment — authorised administrators may provide:
- Institutional contact names, professional email addresses, and job titles
- University name, country, and department information
- IT configuration details necessary for SSO integration
- Information submitted through demo request or whitepaper download forms
2.2 Information Provided by Students
Students access the Services exclusively through their institution's SSO credentials (Microsoft or Google). We do not create or manage separate student login accounts. Through authenticated use of the platform, students may generate:
- Conversational exchanges with the Amal AI wellness companion
- Responses to wellbeing check-ins and structured coaching exercises
- Goal-setting inputs and self-reported wellness data
- Crisis-related disclosures, which trigger our safety escalation protocols
2.3 Information Collected Automatically
When individuals access our Services, we automatically collect certain technical data, including:
- IP address and approximate geographic region (country-level only)
- Browser type, operating system, and device category
- Session timestamps and feature interaction patterns
- Platform performance and error logs (anonymised where possible)
We use this information solely to maintain, secure, and improve the Services. We do not use this data for behavioural advertising or user profiling.
2.4 What We Do Not Collect
Amal.care is designed with data minimisation as a foundational principle. We do not collect:
- National identity numbers, passport details, or government-issued ID information
- Financial or payment information of any kind (our institutional billing is handled separately via formal agreements)
- Images, video, or audio recordings — all media uploads are structurally blocked at the infrastructure level
- Location data beyond country-level identification
How We Use Personal Information
We process personal information only for lawful, specific purposes. The primary bases on which we process data are: performance of a contract or institutional agreement, legitimate interests in operating a safe and effective platform, and compliance with applicable law.
We use personal information to:
- Deliver and personalise the AI wellness coaching Services to authenticated students
- Enable our safety escalation protocols, including alerting designated campus staff when a student discloses a severe concern
- Provide institutional administrators with aggregated, anonymised usage and outcomes data
- Respond to enquiries submitted through our website, including demo requests and whitepaper downloads
- Maintain the security, integrity, and performance of our infrastructure
- Comply with our legal obligations under applicable GCC and regional data protection law
- Improve our Services through analysis of de-identified and aggregated data — we do not train AI models on identifiable student data
Our Commitment to Data Sovereignty
Data sovereignty is central to Amal.care's design. We do not transfer student or institutional data outside GCC infrastructure.
- All data is hosted on AWS Middle East (Bahrain and UAE regions)
- No personally identifiable information (PII) is transmitted to external AI model providers. Our proprietary middleware strips all identifying information before any content reaches a large language model
- We do not sell, rent, or broker personal information to any third party
- We do not use student data for advertising, profiling, or commercial purposes beyond the Services
Disclosure of Personal Information
We do not share personal information with third parties except in the following limited circumstances:
5.1 Designated Campus Personnel
Where a student discloses a Severe Issue within the platform, our safety protocols automatically notify designated on-call campus staff or the institution's counselling team. This disclosure is limited to the content that triggered the safety escalation and is a core feature of the Services agreed upon in the institutional agreement.
5.2 Technology Service Providers
We engage a small number of carefully selected sub-processors to operate our infrastructure. These include cloud hosting (AWS MENA), identity authentication providers (Microsoft and Google SSO), and communication services for institutional alerts. All sub-processors are bound by data processing agreements that restrict use to the purposes for which they are engaged.
5.3 Legal and Regulatory Requirements
We may disclose personal information where required to do so by applicable law, court order, or regulatory authority. We will, where permitted, notify affected institutions prior to any such disclosure.
5.4 Business Transitions
In the event of a merger, acquisition, or restructuring, personal information may be transferred to a successor entity. We will notify institutions of any such transfer and ensure the successor entity is bound by commitments no less protective than those in this Policy.
Data Retention
We retain personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law.
- Student conversational data: retained for the duration of the institutional agreement and deleted within 60 days of agreement termination
- Institutional contact information: retained for the duration of the commercial relationship plus a reasonable period for legal compliance
- Automated safety alert logs: retained for a maximum of 12 months from the date of the alert, then permanently deleted
- Website enquiry data (demo requests, whitepaper downloads): retained for up to 24 months for legitimate business follow-up purposes
We do not archive or retain student data indefinitely. Deletion is permanent and irreversible, using industry-standard secure deletion methods.
Security Measures
We apply a layered, enterprise-grade security architecture to protect all personal information processed through the Services:
- AES-256 encryption for all data at rest and TLS 1.2+ for all data in transit
- Proprietary PII stripping middleware that removes identifying information before any content is processed by AI systems
- Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis
- Annual penetration testing conducted by independent third-party security firms
- Structural blocking of all image and media uploads at the infrastructure level
- Continuous monitoring and anomaly detection on all production systems
No security system is infallible. In the event of a personal data breach, we will notify affected institutions and, where required, relevant regulatory authorities within the timeframes prescribed by applicable law.
Your Rights
Individuals whose personal information we process have the following rights, subject to applicable law:
- Right of access: to request a copy of the personal information we hold about you
- Right to rectification: to request correction of inaccurate or incomplete information
- Right to erasure: to request deletion of your personal information, subject to any overriding legal obligations
- Right to restriction: to request that we limit the processing of your information in certain circumstances
- Right to object: to object to processing based on legitimate interests
- Right to data portability: to receive your information in a structured, commonly used format
To exercise any of these rights, please contact us at privacy@amal.care. We will respond within the timeframe required by applicable law, and no later than 30 days from receipt of your request. Students wishing to exercise rights in relation to data held by their institution should contact their institution directly.
Cookies and Tracking
Our website uses a minimal set of cookies strictly necessary for its operation. We do not deploy third-party advertising cookies, behavioural tracking pixels, or any form of cross-site user profiling on our platform.
You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may affect the functionality of the platform. We do not use cookies to identify or track student users within the Services.
AI Transparency
The Amal wellness companion is powered by artificial intelligence. Students interacting with the platform are communicating with an AI system, not a human being. The AI is designed and governed by our S.U.R.E. Framework (Safe, Understandable, Restricted, Ethical), which sets hard boundaries on the types of responses the system may generate.
The AI companion is not a licensed clinical professional. It does not diagnose, treat, or provide therapy for any medical or mental health condition. In any situation involving risk to life, the system is designed to immediately surface emergency contact information and notify designated campus personnel.
Children and Minors
The Services are designed for use by adults enrolled at university (18 years and above). Access is gated through institutional SSO, which is controlled by the partner university. Amal.care does not knowingly collect personal information from individuals under the age of 18 without the involvement of their educational institution acting in an appropriate supervisory capacity.
Universities deploying the Services are responsible for ensuring access is limited to eligible adult students in accordance with their own institutional policies and applicable local law.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the Services we offer. Where changes are material, we will provide institutions with advance written notice. The effective date at the top of this document will reflect the date of the most recent revision.
Continued use of the Services following notification of a revised Policy constitutes acceptance of the updated terms. If you do not agree with any revision, please contact us to discuss your options.
Contact Us
For all privacy-related enquiries, requests, or concerns, please contact:
We are committed to addressing all privacy concerns promptly and transparently.
© 2026 Amal Care Ltd. All rights reserved.
Amal.care is not a substitute for professional medical advice, diagnosis, or therapy.