Privacy Policy

We respect your privacy and are committed to protecting it. This policy explains what we collect, why, who we share it with, and what rights you have when you use the Dr. Nariman Asad platform.

The platform's operator is the controller of your personal data. You can reach us at any time at info@narimanasad.com.

What We Collect

Account data: your name, email address, phone number if you add one, and a password stored only as an irreversible hash — nobody can read it back, including us.

Purchase data: what you bought, when, for how much, and under which discount code. We never see or store your card details; payment happens entirely on Stripe's own page.

Learning data: which lessons you have completed and when you last opened each course. This is what makes your progress bar work.

Completion certificates: when you finish a course we issue a certificate carrying a number, your name as you confirm it in Arabic and English, the course and the date.

Attendance data: when you opened a session or consultation link. We record the click on the link only — we cannot see what happens inside the meeting itself.

Public contributions: comments and reviews you write, published under your name after moderation.

Affiliate applications: if you apply to join, what you put on the form — name, email, phone, country, accounts, audience size and plan — so we can review it and reply. We keep it after the decision, either way, as a record of who has worked with us. If you are accepted and have no account, we create one with your name and email and send you a link to set your password, valid for seven days.

Technical data: browser type, IP address and error logs, used to run and secure the site.

Why We Collect It

To deliver what you bought and keep your place in it, to issue your certificates, to process payments and refunds, to send order, booking and reminder emails, to protect the platform from abuse, and to meet our legal and accounting obligations.

We send one reminder if a course you started sits unfinished for three weeks, and never a second for the same pause. We send no other marketing email without your consent.

Only if you accept advertising cookies do we measure how our ads on Meta, TikTok and Google perform (see Cookies). Without that consent, nothing about your visit reaches an advertising platform.

Who We Share It With

Stripe, to take payment. Stripe receives your email address and the order's amount and reference, and is the only party that handles your card details.

Cal.com, to schedule one-to-one consultations. It receives your name, email and the duration you booked, in order to create the appointment and issue the meeting link.

Cloudflare R2, to store and deliver files and video.

The email provider we send confirmations and reminders through.

The people you learn with: the instructor running a live class you joined sees your name on that class's list and whether you opened its link, and the consultant you book receives your name and email through Cal.com. Each sees this for their own sessions only — not your progress or purchases, and nothing about anyone else's content.

Meta (Facebook and Instagram), TikTok and Google — only if you accept advertising cookies. They receive the pages you visited and what you did there (viewing a course, adding to the cart, a purchase with its amount and order reference, signing up, sending a form), with the identifiers their own cookies set in your browser. We do not send them your name, email address or phone number.

Anyone you give your certificate number or link to: the certificate's check page shows whoever opens it the name on the certificate, the course, the date, and whether it is still valid. The page is kept out of search engines, and only someone with the number can reach it.

We do not sell your data, and disclose it to no one else except as described above or under a binding legal obligation.

Where Your Data Is Held

Your data may be processed or stored outside your own country, because the service providers above operate globally.

Where local law requires it — as Saudi Arabia's PDPL does, keeping personal data in the Kingdom by default and permitting a transfer only under equivalent safeguards and a risk assessment — we establish a lawful transfer basis before any transfer, and move no more data than the service needs.

How Long We Keep It

Account and progress data for as long as your account exists, because deleting it would mean losing access to what you paid for.

Order and invoice records for as long as tax and accounting rules require, which can outlast a closed account.

Certificates for as long as your account exists, so that they can still be checked. A revoked certificate stays on record as revoked, so it never shows as valid. If you ask us to delete your account, your certificates go with it and their check pages stop working.

Archived drafts are purged automatically after ninety days.

Your Rights

You may ask us to give you access to your data, correct it, delete it, provide a portable copy, restrict or object to a particular use, or withdraw a consent where consent was the basis for it.

We respond within the period the applicable law sets. If we refuse a request we will say why, and you may ask us to review that decision and then complain to the supervisory authority in your country.

These rights are offered to everyone equally, whether you are in the MENA region or the United States, rather than being gated on where you live. We do not discriminate against anyone who exercises them: no change to your price and no change to your access.

For US residents: we do not sell personal information. The advertising cookies described under Cookies may count as sharing for cross-context behavioural advertising under some state laws; they load only if you accept them, and you can withdraw at any time through "Cookie settings" at the foot of every page.

To make a request, email info@narimanasad.com from the address on your account.

Children

The platform is not directed at anyone under 13, and we do not knowingly collect their data. If we learn of an account created for a child without a guardian's consent, we delete it. Anyone between 13 and the age of majority uses the platform with a guardian's consent and under their responsibility.

Cookies

Strictly necessary cookies: one that holds your sign-in session, one that remembers the language you chose, and one that remembers your answer about advertising cookies. Your cart is kept in your own browser and does not reach us until you check out.

Advertising cookies, only with your consent: if you accept them, the Meta Pixel, the TikTok Pixel and the Google Ads tag load and set their own cookies, so we can tell which ads bring visitors and purchases. None of them loads until you choose, and declining keeps it that way. Your answer is kept for a year, and you can change it at any time through "Cookie settings" at the foot of every page.

Security

Passwords are hashed, traffic is encrypted, and administrative access is limited to those who need it. No platform is impregnable, though; if a breach affects your data we will notify you and the relevant authority as quickly as the law requires.

Changes to This Policy

We may update this policy. The last-updated date appears at the top of the page, and we will notify you of material changes by email or an in-platform notice before they take effect.