Cookie Policy

Cookie Policy

Milena Aesthetic | milenaaesthetic.com

Website: https://milenaaesthetic.com/

Applicable jurisdiction: United Arab Emirates

1. Introduction

This Cookie Policy explains how MILENA AESTHETIC CLINIC LLC, operating under the Milena Aesthetic brand ("Milena Aesthetic", "we", "us" or "our"), uses cookies and similar technologies when a person visits or interacts with https://milenaaesthetic.com/ and its language versions, pages, forms and related online features (collectively, the "Website").

The purpose of this Policy is to provide clear information about the technologies used on the Website, the reasons for using them, the information they may collect, the period for which they may remain active and the choices available to Website visitors. This Policy also explains how optional analytics technologies are controlled through the Website's consent mechanism.

This Cookie Policy should be read together with our Privacy Policy, Terms and Conditions and any privacy information displayed next to an appointment, consultation, enquiry, photograph-upload or other form. If there is a conflict concerning the use of cookies and similar technologies, this Cookie Policy applies to those technologies, while the Privacy Policy applies to the broader processing of personal data.

2. Website operator and contact details

For the purposes of applicable UAE data protection requirements, the Website is operated by the following organisation:

3. Scope and applicable framework

This Policy is intended to describe the Website's use of cookies in a manner consistent with the principles of transparency, purpose limitation, data minimisation, security and accountable processing reflected in Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (the UAE PDPL), other applicable UAE legislation and relevant regulatory guidance.

The UAE PDPL defines consent as a specific, clear and unambiguous indication given through a positive statement or action. Accordingly, optional analytics technologies on this Website should not be activated merely because a visitor has continued browsing, scrolled a page or failed to respond to the cookie banner. A visitor must make an active choice before optional analytics scripts are loaded.

Certain healthcare information may also be subject to additional confidentiality, security and data-location requirements under UAE healthcare legislation and rules issued by the competent health authority. Cookies and analytics technologies are not intended to collect medical records or information provided for diagnosis, treatment or clinical care.

4. What cookies and similar technologies are

4.1 Cookies

A cookie is a small text file placed on a computer, smartphone, tablet or other device when a person visits a website. A cookie may contain an identifier and limited information that allows a website or service provider to recognise a browser during a session or on a later visit.

4.2 Similar technologies

The Website and its service providers may also use technologies that perform functions similar to cookies, including JavaScript tags, pixels, web beacons, local storage, session storage, device and browser signals and server-side request logs. These technologies may record whether a page was viewed, which link was selected, the time of an interaction or technical characteristics of the browser and device.

4.3 Session and persistent cookies

Session cookies normally expire when the browser is closed. Persistent cookies remain on the device for a specified period or until they are deleted. The duration stated in this Policy is the usual maximum configured by the Website or provider; browsers, privacy settings and provider changes may shorten that period.

4.4 First-party and third-party cookies

First-party cookies are set for the milenaaesthetic.com domain. Third-party cookies are set or read by an external provider. Some analytics providers use a combination of first-party identifiers, third-party requests and browser storage. The fact that a cookie is first-party does not necessarily mean that the information remains only with Milena Aesthetic; information may be transmitted to the analytics provider that supplied the technology.

5. Categories of cookies used

5.1 Strictly necessary cookies

Strictly necessary cookies support functions that are required to deliver and secure the Website. They may maintain a temporary session, protect forms, prevent misuse, apply security controls and remember whether a visitor accepted or rejected optional cookies. The Website may not work correctly if these cookies are blocked at browser level.

5.2 Functional cookies

Functional cookies remember choices that improve convenience, such as language or interface preferences. At the date of this Policy, the Website does not intentionally deploy a separate category of optional functional cookies. If such functionality is added, this Policy and the consent interface must be updated before the relevant technology is activated.

5.3 Analytics cookies and technologies

Analytics technologies help us understand the number of visits, traffic sources, page performance, navigation paths and interaction with Website elements. They may distinguish browsers using identifiers and may collect technical information such as IP address, user agent, device type, approximate location and page URL. These technologies are optional and should be activated only after consent.

5.4 Advertising and profiling cookies

At the date stated above, the Website code reviewed for this Policy does not intentionally load a dedicated advertising pixel before consent. Google Tag Manager can, however, be used to deploy additional tags. No advertising, remarketing or profiling tag may be added to the container without first updating this Policy, assessing the data flow and configuring an appropriate consent category.

6. Purposes for which cookies are used

Depending on their category and the visitor's choice, cookies and similar technologies may be used to: establish and maintain a secure technical session; deliver Website pages, forms and interactive features; remember the visitor's cookie choice for a limited period; protect the Website, its users and infrastructure against errors, abuse and security threats; measure visits, page views and traffic sources; understand how visitors navigate, scroll, click and interact with Website content; identify technical faults and opportunities to improve accessibility, performance and content; evaluate the effectiveness of non-clinical communications and Website campaigns; and produce aggregated reports that support Website administration and improvement.

Cookies and analytics technologies must not be used to make medical decisions, diagnose a condition, determine treatment suitability or create a clinical profile about a Website visitor.

7. Lawful basis and consent

Strictly necessary cookies are used to provide, secure and administer the Website and to record the visitor's privacy choice. Optional analytics technologies are used on the basis of the visitor's consent where consent is required or selected as the appropriate basis.

Consent must be freely given, specific, informed and unambiguous. Accepting optional analytics is not a condition of viewing general Website content. The Website should provide options of equivalent prominence to accept all optional cookies or reject them. Where granular settings are offered, categories must not be preselected by default.

The Website records the chosen state in the milena_cookie_consent cookie for 30 days. When that period expires, or when the cookie is deleted, the visitor may be asked to make a new choice. We may request renewed consent earlier if analytics purposes, providers or technologies materially change.

8. Strictly necessary Website technologies

8.1 PHP session cookie

The Website currently uses PHP and may set PHPSESSID to maintain a temporary session. This cookie supports core server-side functionality. It is marked as HttpOnly and Secure in the current configuration so that it is not ordinarily available to client-side scripts and is transmitted over an encrypted connection.

8.2 1C-Bitrix cookies

The Website is built on 1C-Bitrix. Depending on the page and function used, the platform may create cookies with the BITRIX_SM_ prefix. These cookies may support session management, security, interface preferences, form handling or other platform functions. Exact cookie names can vary according to enabled modules and configuration.

8.3 Consent preference

The milena_cookie_consent cookie stores the values accepted or rejected. Its purpose is to avoid repeatedly displaying the banner during the configured 30-day period and to ensure that optional analytics scripts are loaded only when the saved choice permits them.

9. Analytics services

9.1 Google Tag Manager

The Website uses Google Tag Manager container GTM-KJDRHDXJ to manage analytics code. Google Tag Manager is a tag-management system. It can load other scripts and does not by itself determine the purposes for which those scripts are used. The data collected depends on the tags configured in the container.

The Website implementation is designed to load the container only after a visitor accepts optional analytics. Container access and publishing permissions must be restricted to authorised personnel. Any new tag must be reviewed before publication to ensure that this Policy, the cookie banner and the consent configuration remain accurate.

9.2 Google Analytics

Where Google Analytics is enabled through Google Tag Manager, it may use first-party cookies such as _ga and gato distinguish browsers and maintain session state. Google states that the default expiration period for these cookies is up to two years, although browser restrictions may shorten that period.

Information transmitted to Google may include page URL, referral information, time of access, events, approximate location, browser and device characteristics and an IP address processed as part of the network request. Google Analytics must not receive names, telephone numbers, email addresses, appointment details, medical information or other information that directly identifies a patient or prospective patient.

9.3 Yandex Metrica

The Website uses Yandex Metrica counter 108681486. When activated following consent, Yandex Metrica may use browser identifiers stored in cookies or local storage to measure visitors, sessions, traffic sources, page views and interactions. Depending on the user's location and provider configuration, Yandex-domain cookies may also be used.

Yandex documentation states that Metrica may process information such as the IP address, page URL, browser and operating-system information, device characteristics, referral information, cookie identifiers and events produced by interaction with the Website. The main identifiers and their typical retention periods are listed in Appendix A.

9.4 Yandex Webvisor / Session Replay

The current Yandex Metrica configuration enables Webvisor, also described as Session Replay. This technology may reproduce aspects of a visit, including page navigation, scrolling, pointer movement, clicks and interaction with page elements. Session replay presents a higher privacy risk than basic aggregated traffic measurement and must therefore remain disabled until optional analytics consent has been provided.

Webvisor must be configured so that information entered into appointment, enquiry, consultation, upload and medical-information fields is not recorded or transmitted. Passwords, contact details, free-text messages, photographs, symptoms, treatment interests linked to an identifiable person and other sensitive information must be masked or excluded. If reliable exclusion cannot be demonstrated, Webvisor should be disabled.

9.5 Ahrefs Web Analytics

The Website uses Ahrefs Web Analytics to produce aggregated information about page views, referrals and common interactions. Ahrefs states that its Web Analytics product does not use cookies or persistent identifiers by default and does not retain raw IP addresses. It may process the page URL, referrer, user-agent information, language settings and approximate city-level location derived from an IP address.

Although Ahrefs Web Analytics is described as cookie-free, its script initiates a request to a third-party provider and processes usage information. For transparency and consistent visitor choice, the Website currently treats it as an optional analytics technology and loads it only after consent.

10. Third-party content, links and services

The Website contains links to third-party services, including WhatsApp and Google Maps, and may display review images delivered from Google-controlled domains. A standard link does not by itself transfer the contents of a Website form to the destination. However, when a visitor selects a link, opens the third-party service or loads third-party-hosted content, the third party may receive technical information such as IP address, browser details, referral URL and time of access.

WhatsApp, Google Maps and other third-party websites operate under their own terms, privacy notices and cookie practices. Milena Aesthetic does not control cookies placed directly by those services after a visitor leaves the Website or interacts with third-party content. Visitors should review the relevant provider's privacy information before submitting personal or medical information through an external service.

11. Information that may be collected

Subject to the visitor's consent and the configuration of each provider, analytics technologies may process: IP address and an approximate geographic location derived from it; browser type, version, language and privacy settings; device type, operating system, screen dimensions and related technical characteristics; date and time of access and duration of a session; pages viewed, page titles, referral source and navigation sequence; clicks, scrolling, link selections and interaction with Website elements; campaign parameters contained in a page URL; technical events, performance information and errors; and a randomly generated browser, session or analytics identifier.

Analytics identifiers may constitute personal data where they can distinguish a person's browser or be combined with other information. For that reason, analytics information is handled in accordance with this Policy even where provider dashboards describe it as anonymous or depersonalised.

12. Medical and health information

The Website relates to aesthetic medicine and healthcare services. A visitor's enquiry, requested procedure, photographs, allergies, symptoms, medical history, appointment details and other consultation information may reveal health information. Such information requires a higher level of confidentiality and must not be intentionally collected through analytics cookies or session-replay tools.

Website administrators and marketing personnel must not configure analytics events, campaign parameters, page addresses or tag-manager variables to contain a person's name, telephone number, email address, patient number, appointment identifier, photograph filename, diagnosis, symptom or treatment record. Form submissions should be measured only through a generic completion event that does not reproduce the submitted content.

Information voluntarily submitted through a Website form, telephone call, email or WhatsApp conversation is governed by the Privacy Policy and the privacy information associated with the relevant service. It is not governed solely by this Cookie Policy.

13. International processing and data location

Some analytics and third-party service providers operate infrastructure in multiple countries and may process technical or analytics information outside the United Arab Emirates. Provider processing locations may change according to the service architecture, the visitor's network location and the provider's contractual arrangements.

Where personal data is transferred internationally, Milena Aesthetic will assess and apply the requirements of applicable UAE legislation. Health and medical information submitted for the provision of healthcare services must not be intentionally included in analytics requests or transferred to analytics providers.

Hosting the Website and its primary database in the UAE does not by itself ensure that every analytics request remains in the UAE. Each external script, embedded resource, backup service, log service and communications platform must be assessed separately.

14. Retention

Cookie retention periods are listed in Appendix A. A provider may retain analytics reports for a different period from the lifespan of the cookie stored in the browser. Deleting a cookie prevents it from continuing to identify the browser through that cookie, but it does not automatically delete information already included in an aggregated or provider-side report.

Milena Aesthetic will configure analytics retention periods so that information is not retained for longer than reasonably necessary for Website measurement, security and improvement. Access to analytics reports should be periodically reviewed, and obsolete properties, containers, user accounts and exports should be deleted or disabled.

15. Managing and withdrawing consent

On the first relevant visit, the Website displays a cookie banner that allows the visitor to accept all optional analytics technologies or reject them. Strictly necessary technologies remain active because they support the Website and store the visitor's choice.

A visitor may change or withdraw consent at any time by selecting Cookie Settings in the Website footer. Withdrawal should be as easy as giving consent. After withdrawal, the Website should stop loading optional analytics scripts and remove first-party analytics cookies that it is technically able to remove. Withdrawal does not invalidate processing that occurred before consent was withdrawn.

A visitor may also delete the milena_cookie_consent cookie through browser settings. The cookie banner will normally appear again on the next visit, allowing a new choice. Blocking all cookies at browser level may prevent sessions, forms or other Website features from operating correctly.

16. Browser controls

Most browsers allow users to view, delete or block cookies and clear local storage. The available controls differ by browser and device. They are generally found under Privacy, Security, Site Data or Cookies in the browser settings.

Browser controls may allow a user to: delete cookies and site data for the Website; block third-party cookies; block all cookies or permit only selected sites; clear cookies automatically when the browser closes; and review permissions and stored data for individual websites.

Because browser settings operate independently of the Website, changing a browser setting may affect other websites as well. Users should consult their browser provider's current help documentation for device-specific instructions.

17. Do Not Track and Global Privacy Control

Some browsers and extensions transmit Do Not Track or Global Privacy Control signals. There is not yet one universally applied technical standard for every such signal in all jurisdictions.

The Website's primary method for controlling optional analytics is the cookie banner and Cookie Settings interface. Where technically feasible and appropriate, recognised browser privacy signals may also be used to restrict optional analytics.

18. Children's privacy

The Website provides general information about the clinic and is not designed to collect children's personal data through cookies for advertising or profiling. Optional analytics technologies are not intended to identify a child. A parent or legal guardian should supervise a child's use of the Website and should contact the clinic directly before submitting information about a minor.

If we become aware that analytics configuration has resulted in the unintended collection of identifiable information about a child, we will take reasonable steps to investigate, restrict further collection and delete the information where required.

19. Security and governance

We apply reasonable technical and organisational measures to protect Website and analytics information against unauthorised access, alteration, disclosure or loss. Measures may include encrypted HTTPS connections, access controls, multi-factor authentication, restricted tag-publishing permissions, periodic account reviews and monitoring of Website changes.

No internet or analytics system can be guaranteed to be completely secure. The use of cookies should therefore be limited to what is necessary for the stated purpose, and providers should not receive information that is unnecessary for Website measurement.

20. Visitor rights

Depending on the circumstances and applicable UAE law, a person may have rights concerning personal data associated with analytics or other Website processing, including rights to obtain information, request correction or deletion, restrict or object to certain processing, stop processing in applicable circumstances and withdraw consent.

Because analytics information may be stored under a browser identifier rather than a name, we may need information from the requesting person to determine whether a record can reasonably be located and verified. We will not request more information than necessary to assess and respond to a request.

Requests may be sent to info@milenaaesthetic.com. Further information about rights, verification and complaint handling is provided in our Privacy Policy.

21. Changes to this Policy

We may update this Cookie Policy when the Website, providers, purposes, cookie names, retention periods or legal requirements change. The revised version will be published on this page with a new Last updated date.

Where a change materially expands optional processing, we will update the consent interface and, where appropriate, request a new consent before the changed technology is activated. The cookie register should be technically audited at reasonable intervals and after every material Website or tag-manager release.

22. Contact us

Questions about this Cookie Policy, cookie preferences or the processing of Website information may be directed to:

MILENA AESTHETIC CLINIC LLC, Villa D01, 892 Al Wasl Road, Umm Suqeim 1, Dubai, UAE Email: info@milenaaesthetic.com Telephone: +971 56 454 4425

Appendix A — Detailed cookie and technology register

The register below describes technologies identified in, or reasonably associated with, the Website's current technical configuration. Providers may change cookie names and durations. The register must therefore be verified against the live production Website before publication and after material configuration changes.

Register interpretation: A cookie appearing in this register is not necessarily set during every visit. Its presence depends on consent, browser settings, provider responses, page functionality and tag-manager configuration. Conversely, a provider update may introduce a new technical identifier before this document is next reviewed. Material changes must be assessed and disclosed promptly.

Appendix B — Provider and regulatory information

UAE Personal Data Protection Law: https://uaelegislation.gov.ae/en/legislations/1972 UAE Government — Data protection laws: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws TDRA Internet Guidelines: https://tdra.gov.ae/en/About/tdra-sectors/information-and-digital-government/policy-and-programs-department/internet-guidelines Google Analytics cookie usage: https://support.google.com/analytics/answer/11397207 Yandex Metrica cookie usage: https://yandex.com/support/metrica/en/general/cookie-usage Yandex Metrica notice and deferred loading: https://yandex.com/support/metrica/en/general/notification Ahrefs Web Analytics documentation: https://help.ahrefs.com/en/articles/10247870-about-ahrefs-web-analytics