Privacy Policy

Controller / responsible entity

Migraine Heroes Tech Ltd
IH-00-01-03-OF-05
Level 3, DIFC Innovation One
Dubai AI Campus
Dubai International Financial Centre
Dubai, United Arab Emirates

Privacy contact

hero@migraineheroes.com

Privacy lead

We have appointed Diane Ducarme as our Privacy Lead to oversee our data protection programme. She is based in Belgium and can be contacted at hero@migraineheroes.com. Where required by applicable law, we may also appoint a local representative or Data Protection Officer.

This Privacy Policy applies to personal information we collect through our website, the Migraine Heroes mobile application, onboarding forms, trackers, tongue photo uploads, surveys, questionnaires, in-app interactions, practitioner or customer-care communications, email, WhatsApp, SMS, video calls, social media, payments, subscriptions, account management, research, product development, analytics, and service improvement activities.

It applies whether you use a free, trial, automated, or practitioner-supported version of our service.

Because Migraine Heroes serves people in multiple countries, we comply with applicable privacy laws, including the DIFC Data Protection Law, the GDPR and UK GDPR where they apply, and other privacy, consumer protection, health-data, and data-breach notification laws that apply to our services.

We collect personal information that you provide to us, that is generated through your use of Migraine Heroes, or that we receive from service providers acting on our behalf, such as Stripe, Apple App Store, Google Play, hosting, analytics, communications, or support providers.

4.1 Account and identity information

This may include your name, email address, phone number, country or region, language preference, date of birth or age range, account settings, login details, subscription plan, trial status, payment status, and support history.

4.2 Health, wellness, and lifestyle information

Because Migraine Heroes provides personalised migraine and wellness support, we collect information that may be considered health data, sensitive personal data, or special-category personal data under applicable law. This may include migraine frequency, symptoms, pain patterns, triggers, prodrome and postdrome signs, sensory sensitivity, sleep, stress, mood, digestion, menstrual cycle and hormonal symptoms, medication and supplement information you choose to provide, food preferences, allergies, intolerances, diet type, medical history or diagnosed conditions you choose to share, pregnancy or breastfeeding information, perimenopause information, tongue photos and related observations, tracker entries, survey answers, questionnaire responses, and notes or messages you send to our team.

You should not provide information that you do not want us to process. If you choose not to provide certain information, some personalised features may not work properly or may be unavailable.

4.3 Communications and support information

This may include email, chat, SMS, WhatsApp, video-call, social-media, or customer-support content; call notes where relevant; feedback; testimonials; research responses; and preferences about how and when we contact you. Third-party communication platforms have their own privacy and security practices.

4.4 Payment and transaction information

This may include your subscription plan, billing status, payment confirmation, invoice and transaction details, and refund or cancellation information. We generally rely on providers such as Stripe, Apple, Google, or similar providers to process payment card details, and we do not store full credit card numbers on our own systems.

4.5 Technical, device, and usage information

We collect technical information about the device, browser, app, and network you use, such as your device type, operating system, app version, IP address, approximate location, log files, crash reports, pages or screens viewed, and how you interact with the service. We use this information to operate, secure, troubleshoot, analyse, and improve Migraine Heroes.

We may collect personal information when you create an account, complete onboarding, use trackers or questionnaires, upload tongue photos, interact with recommendations or content, subscribe to emails, contact us, participate in research or testing, purchase or manage a subscription, use our website or app, interact with our social media pages, or accept cookies and similar technologies.

We may also collect limited information from third-party providers, such as payment providers, analytics providers, app stores, hosting providers, authentication providers, customer-support tools, and communications platforms.

6.1 To provide and personalise Migraine Heroes

The information you provide allows us to build your personal migraine history. Over time, we use your tracker entries, symptoms, food and lifestyle information, medication information where provided, and tongue photos to identify patterns and generate personalised wellness insights. The more consistently you use Migraine Heroes, the more personalised your experience can become. Specifically, we use your personal information in order to:

• understand your migraine and wellness patterns;
• personalise your experience, recommendations, insights, and educational content;
• suggest foods, habits, tracking actions, or non-invasive support options;
• adapt recommendations based on your tracker entries, symptoms, tongue photos, and progress;
• provide practitioner-supported services where included in your plan;
• send reminders, check-ins, and service-related notifications where enabled;
• help you track your progress over time;
• create and administer your account.

6.2 To communicate with you

We use your information to respond to questions and support requests, send account, subscription, billing, security, service, and legal messages, send reminders where enabled, and communicate through your preferred channels where possible.

6.3 To improve, secure, and operate Migraine Heroes

We use information to operate and maintain our website, app, and systems; troubleshoot bugs; improve design, features, content, and customer experience; test product flows; monitor performance; detect and respond to fraud, abuse, security incidents, or misuse; and train our team and improve internal processes.

6.4 Research and product development

We conduct research and product development to understand migraine and wellness patterns, improve recommendation logic and educational content, evaluate whether features are helpful, identify trends, and develop or validate algorithms and product features.

Where possible, we use aggregated, anonymised, or de-identified information. Where we need identifiable health-related information for a specific research activity, we rely on your explicit consent or another lawful research basis where permitted by applicable law and supported by safeguards such as data minimisation, pseudonymisation where feasible, access controls, and restrictions on further use.

Participation in optional research, interviews, studies, surveys, or user testing beyond normal use of the app is voluntary. We will explain what is involved and obtain any required separate consent before you take part.

6.5 Marketing and educational communications

With your consent where required, we may send newsletters, product updates, educational content, podcast updates, offers or promotions, surveys, or feedback requests. You can change your choices at any time by using the unsubscribe link in any marketing email or contacting us at hero@migraineheroes.com. Even if you unsubscribe from marketing, we may still send important service, account, legal, security, or transactional messages.

6.6 Legal, regulatory, and safety purposes

We may use information to comply with legal, regulatory, tax, accounting, or reporting obligations; respond to lawful requests from authorities, courts, regulators, or law enforcement; enforce our terms and policies; resolve disputes; and protect the rights, safety, security, and property of Migraine Heroes, our team, customers, or others.

Where laws such as the GDPR or DIFC Data Protection Law require a legal basis, we rely on one or more of the following:

• Consent, including explicit consent for health information, tongue photos, optional research, and certain communications where required.
• Contract, where processing is necessary to provide the service you requested or to take steps before entering into a contract with you.
• Legitimate interests, such as securing our systems, understanding usage, preventing fraud, improving the service, and supporting customers, provided your rights do not override those interests.
• Legal obligation, where processing is necessary to comply with applicable law.
• Vital interests, in rare cases where processing is necessary to protect someone’s life or safety.

Migraine symptoms, medication information, reproductive health information, tongue photos, and similar information are treated as sensitive health information. We process this information for core personalisation features only where we have your explicit consent or another lawful basis that applies to the specific activity. You can withdraw consent at any time. Doing so may limit or disable personalised features.

Migraine Heroes may ask you to upload tongue photos as part of the service. Tongue photos may reveal health-related information and are treated as sensitive health information.

We use tongue photos to support pattern recognition, personalised wellness insights, progress tracking, and practitioner review where included in your plan.

We do not use tongue photos for facial recognition or to identify you as a person.

Please avoid including your full face, open eyes, or unnecessary background information in tongue photos.

If a photo inadvertently includes your eyes or other identifying features, you can use the in-app photo adjustment tools to zoom or crop further, where available, so the image excludes your eyes or other unnecessary identifying features. You can also contact hero@migraineheroes.com to request manual adjustment, review, or deletion of a specific image.

Migraine Heroes uses algorithms, structured decision rules, and technology-assisted processes to generate personalised insights and recommendations based on the health and lifestyle information you provide.

These recommendations are intended for wellness, education, and self-management support. No automated process within Migraine Heroes makes decisions that produce legal effects concerning you or similarly significantly affect you without the involvement of a person.

Where our recommendations could meaningfully influence your health-related choices, you may request an explanation of the logic behind a specific recommendation, request human review where available, object to a recommendation, or opt out of algorithmically personalised recommendations. If you opt out, we may provide general non-personalised educational content instead. Contact hero@migraineheroes.com to exercise these rights.

We may create and use aggregated, anonymised, de-identified, or pseudonymised data derived from personal information to improve Migraine Heroes, understand migraine and wellness patterns, evaluate outcomes and engagement, develop new features, improve recommendations, conduct research, and publish or share insights that do not identify individuals.

Aggregated or anonymised data does not identify you personally. If we combine aggregated or anonymised data with information that can identify you, we treat the combined information as personal information. We will not publish research or reports that identify you without your separate consent.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioural advertising in exchange for money or other valuable consideration.

11.1 Service providers and processors

We share information with trusted providers that help us operate Migraine Heroes, such as cloud hosting, database and infrastructure, authentication, payment, analytics, email and communications, customer support, app store, security and monitoring, professional advisers, and research or product-development partners where appropriate safeguards are in place. These providers may only process personal information for authorised purposes, under contract, and must protect it appropriately.

11.2 Practitioners, team members, and contractors

Our health practitioners or other relevant people of our team may access your information to provide the service. Access is limited to people who need it for their role.

11.3 Legal, regulatory, safety, and business reasons

We may share information where necessary to comply with legal obligations, respond to lawful requests, protect our rights, defend legal claims, investigate fraud or security incidents, protect safety, or in connection with a merger, acquisition, investment, restructuring, sale of assets, or similar transaction, subject to appropriate confidentiality and legal safeguards.

We use service providers, including Google, Apple, and Stripe, whose infrastructure may process your personal information outside your country of residence. These providers are bound by their own data processing agreements, which include standard contractual clauses recognised under the GDPR and DIFC law. Contact hero@migraineheroes.com for questions about international transfers.

We use cookies and similar technologies to operate our website, remember your preferences, and understand how the site is used so we can improve it. Currently, this falls into two categories:

• Strictly necessary cookies (e.g., security, session handling), needed for the site to function. These don't require consent, and we disclose them here for transparency.
• Analytics cookies (Google Analytics), which help us understand how visitors use the site, such as which pages are visited and how. These require your consent.

We do not currently use cookies for advertising or marketing purposes. If that changes in the future, we'll update this policy and the cookie banner accordingly.

This may include information such as browser type, device information, pages visited, time spent on pages, referral source, and interactions with website content.

When you first visit the site, a cookie banner lets you accept or reject analytics cookies, with the option to review more detail before deciding. Necessary cookies apply regardless, since the site can't function without them. You can change your preference at any time using the “Cookie preferences” link in the site footer.

We apply this same consent approach to every visitor, regardless of location.

You can also adjust your browser settings to block or delete cookies at any time. Some parts of the website or app may not function properly without certain cookies.

If you subscribe to our emails, we may use an email platform to send newsletters, updates, educational content, and service communications. Email platforms may provide information such as whether an email was opened or whether a link was clicked, which we use to improve our communications and understand engagement. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link or contacting hero@migraineheroes.com.

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, or destruction. These measures include encryption, access controls and role-based permissions, authentication safeguards, secure cloud infrastructure, logging and monitoring, data minimisation, confidentiality obligations, vendor due diligence, backup and recovery procedures, and security incident response processes.

If we become aware of a security incident that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority where legally required and within the timeframes required by applicable law. If you believe your account or information has been compromised, please contact hero@migraineheroes.com promptly.

You can ask us to delete your personal information at any time, and we will do so, except for specific records the law requires us to keep. Otherwise, we keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Where a person under 18 uses Migraine Heroes, we process their personal information only with the consent of a parent or guardian, given through our consent flow. Who can use Migraine Heroes is set out in our Terms of Use.

If you are a parent or guardian and believe a child has provided us with personal information without appropriate consent, please contact hero@migraineheroes.com so we can investigate and, where appropriate, restrict access, obtain consent, delete the account, or delete associated data.

Depending on where you are located and which law applies, you may have the right to request access to your personal information, correction of inaccurate or incomplete information, deletion, restriction of processing, portability of certain information, objection to processing based on legitimate interests or direct marketing, withdrawal of consent, review of certain automated decisions, or to lodge a complaint with a data protection authority.

To exercise your rights, contact hero@migraineheroes.com or use available self-service options in the app. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law. Some rights may be limited where we need to retain information for legal, regulatory, security, research, or dispute-resolution reasons.

Where we rely on consent, including explicit consent to process health data, you can withdraw it at any time. You may do this in-app, where available, by going to Settings > Privacy > Manage Consent, or by contacting hero@migraineheroes.com.

Withdrawing consent does not affect processing that occurred before your withdrawal, and it may mean that some features or personalised services can no longer be provided. If you request full account deletion, we will delete or anonymise your personal information in line with the retention schedule in Section 16, except where we are required or permitted to retain specific records for legal reasons.

If you have concerns about how we process your personal information, please contact us first at hero@migraineheroes.com so we can try to resolve the issue.

Depending on your location and the law that applies, you may also have the right to complain to a data protection authority, including the DIFC Commissioner of Data Protection, an EU data protection authority, the UK Information Commissioner’s Office, or another relevant privacy or data protection regulator.

Our website, app, emails, or content may link to third-party websites, platforms, or services, including app stores, payment providers, communications platforms, analytics tools, social media platforms, and podcast platforms. We are not responsible for the privacy practices of those third parties, and you should review their privacy policies separately.

We may update this Privacy Policy from time to time. If we make material changes, including changes to the purposes for which we use your health data or to the legal bases described in this policy, we will take reasonable steps to notify you, such as by email or a prominent in-app notice. Where a change legally requires fresh consent, we will seek it before applying the change to previously collected data. The updated version will be effective from the date stated at the top of the policy.

This Privacy Policy and any related privacy matters are governed by the laws applicable in the Dubai International Financial Centre, subject to any mandatory privacy or consumer protection rights that apply in your country of residence.

Where applicable, the courts of the Dubai International Financial Centre will have jurisdiction, without limiting any mandatory rights you may have under applicable data protection law. To the extent relevant and permitted under DIFC law, principles of English common law may be considered by the DIFC Courts.