Privacy & data-protection notice

1Who we are (the data controller)

Dubai Leadership Coach is a leadership-mentoring web application delivered as an initiative aligned with the Mohammed Bin Rashid Centre for Leadership Development. The Centre and its delivery partner act as the controller of your personal data — they decide why and how it is processed. If you are unsure who to contact about your data, use the contact details in section 9; we will route your request to the responsible team.

2What personal data we collect

We collect only what the programme needs. Depending on how you use the app, this includes:

• Account details — your display name, email address, and a securely-hashed password.
• Optional profile details — government entity, nationality, phone number and a masked government/Emirates ID reference, only if you choose to provide them.
• Conversation content — the text of your coaching chats and class questions, and your progress, scores and certificates, so your mentor can remember your sessions and continue your journey.
• Live microphone audio — when you speak to a mentor in a class, your microphone audio is processed in real time to understand your question and generate a spoken reply. It is used to answer you in the moment; the app does not store your voice as an audio recording (a text transcript may be saved as part of your conversation history above).
• Camera — your camera is optional and off by default; you are asked before it is ever used, and a session is never camera-mandatory. When you turn it on, your video is streamed live to the hosted avatar service that renders your mentor (see section 5), solely so that the mentor can see you during that conversation. We do not record it, we do not store it, and we do not ask the provider to record or store it; it is not used for any other purpose. The provider does analyse what it sees in order to let the mentor respond to you, and may keep a short written impression of the session. You can turn the camera off at any moment, and the picture you see in the corner is exactly what is being sent.
• Basic technical data — sign-in events and activity needed to operate and secure the service.
• Session feedback you choose to send — after a majlis you may rate the session and write a short note, and give a name, email or phone so the Centre can reply. That message is sent by email to the Centre at Dubai.Leadership@teo.ae and your mentor never sees it. On the platform we keep only the rating, the mentor and the length of the session; your name and contact details stay in the email. Sending feedback is optional and nothing about the majlis depends on it.
• Registering your interest in Dubai Leadership Coach — at the Mohammed Bin Rashid Leaders Forum on Tuesday 13 October 2026, where Dubai Leadership Coach was shown to the public for the first time, and on any screen the Centre puts this page on afterwards, a visitor may enter their first name, last name, job title, organisation, mobile number and email address, rate their experience with the AI coach from one to five, and add a short comment. They tick a box agreeing that the Centre may keep these details in order to contact them among the first when Dubai Leadership Coach is released and to keep them updated about it. That consent is the legal basis for this collection; it can be withdrawn at any time by replying to the confirmation email — whose reply address is the mailbox that receives the registrations — or by writing to the Centre at the address shown on the screen where the details were entered and repeated in that email, without affecting the lawfulness of what was done before it was withdrawn. The details are sent by email to the Centre, and a confirmation email is sent to the address given; the platform limits the confirmation emails sent to any one address, normally to two a day, and to any one recipient organisation. Both emails are carried by the Centre’s email provider, a third party that may process them outside the UAE. Opening the confirmation email may load the Centre’s images from this platform, and the platform records that request — the address it came from, the time and the browser or mail client — as it records any other request made to it; a mail client set not to load remote images makes no such request. Nothing the visitor enters is kept on the screen itself; the screen keeps one small code (a cookie) that tells the platform the Centre’s team activated it — the same code for every visitor, holding nothing about them and identifying nobody, and removed when the screen is deactivated or the activation key is changed. The platform also keeps its own copy of each registration, encrypted, for the period stated on that screen when the registration is made and repeated in the confirmation email — 12 months unless the Centre changes it — and then deletes it automatically; a clock does this, so the deletion does not depend on anyone opening a page. If Dubai Leadership Coach has not been released when that period is nearly over, the Centre emails the visitor about a month beforehand to say when the details will be deleted and to ask whether to keep them; a reply asking to keep them extends the period — that reply is treated as fresh consent and the deletion clock is moved to the new date, which is the date the Centre’s own list then shows — and no reply means they are deleted on that date as originally agreed. Only the Centre’s authorised administrators can see that list, and every time it is read, downloaded, or a row in it is deleted, the action is recorded against the administrator’s account. The email account that sends the two messages keeps a copy in its sent mail, which the Centre deletes when the visitor asks. If a message cannot be sent at once, what is needed to send it is held encrypted until it has been sent or erased — for the confirmation, no longer than 24 hours. The Centre keeps the email it receives in its mailbox only for as long as it needs it to contact the visitor about the release, and deletes it when consent is withdrawn or removal is requested. Because no account is created, what this notice says about accounts does not apply to the visitor; for what is collected, where it goes, how long it is kept and how it is removed, this item applies. The rights in section 7 apply to visitors as to everyone. To have these details corrected or removed — which is done on request and never waits for the retention period to end — reply to the confirmation email — its reply address is the mailbox that actually receives the registrations, which the Centre may change — or write to the Centre at the address shown on that screen and in the confirmation email, quoting the reference number shown on the screen after registering and in the confirmation email (see section 9).

3How we use your data

• To create and secure your account and sign you in.
• To deliver the mentoring programme — run your weekly classes, remember your sessions, track progress, assess mastery and issue certificates.
• To understand your spoken and typed questions and generate the mentor's replies.
• To operate, secure and improve the service, and to comply with legal obligations.

4Legal basis for processing

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), we rely on your consent — given when you create your account — to store your account and conversation history, and on the necessity of performing the service you have asked for to deliver your classes. You can withdraw consent at any time by deleting your data (see section 7); withdrawing consent does not affect processing that already took place.

5Who we share your data with (processors & third parties)

We share personal data only with service providers that help us run the app, under agreements that require them to protect it and use it only on our instructions:

• Hosting & database — the cloud infrastructure that runs the application and stores your account and conversation data.
• AI language services — providers whose language models generate the mentor's coaching replies from your questions.
• Hosted avatar & voice services — the mentors are rendered by third-party real-time avatar providers: Tavus, Anam and HeyGen. For those mentors, your live microphone audio and messages are streamed to the provider, which performs speech-to-text, response generation and text-to-speech to make the avatar speak. These are external companies based outside the UAE and process this data outside the UAE.
• What the mentor is told about you — so that a mentor can continue where you left off, a short briefing is included at the start of a session: your first name and how you wish to be addressed, the summary you approved from your تعارف introduction and CV, and the brief takeaways from your previous sessions. Because the mentor is rendered by the avatar provider above, that briefing is sent to them as part of the conversation. You can review, change or delete all of it at any time from your profile.
• Email delivery — the Centre’s email provider, an external mail service that carries our messages and may process them outside the UAE. It handles every email this platform sends or forwards on your behalf, including account activation and password reset, programme messages about your classes and progress, the session feedback you choose to send, a registration of interest and its confirmation, and your own majlis summary. Whatever you put in those messages travels with them — your name, your email address, your phone number and anything you write — because the message is the delivery. Once a message has arrived in the Centre’s own mailbox it is held by the Centre, not by this platform; sections 6 and 7 say what that means for how long it is kept and how to have it removed.

6How long we keep your data

Your account and conversation history are kept for as long as you have an account — that is, until you delete them. They are not deleted automatically after a fixed period, so that your mentor can remember your journey across sessions. You are always in control: you can delete your data at any time (section 7), and when you do, your account and conversation history are removed. We never store camera video and we do not ask the avatar provider to store it, and live microphone audio is not retained as a recording.

Three things are kept to a fixed clock instead, and deleted automatically when it runs out. Session feedback: when you rate a majlis, the platform keeps the rating, the mentor and the length of the session for 12 months and then deletes them; your name, your contact details and what you wrote are never stored here at all, because they travel only in the email to the Centre (section 5). A registration of interest is kept, encrypted, for the period stated on the screen where it was made and repeated in the confirmation email — see section 2. A message that is waiting to be sent is held encrypted only until it has been sent or erased.

A message that has already reached the Centre’s mailbox is outside this platform’s reach. Deleting your account removes what is on the platform; it cannot remove an email the Centre has already received, because that copy is the Centre’s record and no control in the app can touch it. The Centre keeps it only for as long as it needs it and deletes it when you ask — section 7 says how.

7Your rights & how to exercise them

Under the UAE Personal Data Protection Law you have the right to:

• Access — ask what personal data we hold about you.
• Correct — update inaccurate account or profile details.
• Delete — remove your account and conversation history. You can do this yourself from your profile in the app at any time.
• Withdraw consent — stop future processing that relies on your consent.
• Object / restrict — ask us to limit how we process your data.
• Complain — raise a concern with us and, if unresolved, with the UAE Data Office.

For your account and your conversation history, use the delete control in your profile — it removes them itself. For anything else, contact us using section 9. We aim to respond within the timeframes set by the law.

For a message that has already gone to the Centre by email — session feedback, or a registration of interest — the profile control cannot reach it: that copy sits in the Centre’s mailbox, and it is the record. Ask the Centre to erase it, using the contact details in section 9, and quote the reference shown to you on screen when you sent it and repeated in your confirmation email; you may also simply reply to that email. This is done on request and does not wait for any retention period to end.

8How we protect your data

Access is over encrypted (HTTPS) connections, passwords are stored only as secure hashes, sensitive identifiers such as any government/Emirates ID reference are encrypted at rest, and access to the systems that hold your data is restricted to authorised operators. No online service can be guaranteed perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.

9Contact us about your data

For any question about this notice or to exercise your rights, please reach us through the Contact us page. Tell us it concerns your personal data and we will route it to the responsible team.