Privacy Notice

1. Who we are

Zest Life LLC-FZ (“Zest”, “we”, “us” or “our”) is a company registered in Meydan Free Zone, Dubai, United Arab Emirates. For the personal data described in this notice, Zest is the data controller: we decide why and how that data is processed.

This notice is intended to reflect the requirements of the UAE Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data and other applicable UAE laws. It does not apply to third-party websites or services that have their own privacy notices.

2. Personal data we collect

When you use the Zest Check quiz

We collect:

• your email address and, if you provide it, your first name;
• your answers to questions about energy, sleep, appetite, recovery, body changes and lifestyle habits;
• the priority you select and the lifestyle pattern generated from your answers;
• whether certain answers triggered a general safety message encouraging a conversation with a qualified clinician;
• the date and time of your consent and submission; and
• a protected, one-way identifier derived from your IP address for abuse prevention and rate limiting. The quiz database does not store your plain IP address, although our hosting provider may retain ordinary server logs separately.

When you visit the website

Our systems and hosting providers may process technical information such as your IP address, browser and device type, requested pages, date and time, referring page, and security or error logs. External font or infrastructure providers may receive the technical information normally sent when your browser requests their resources.

When you contact us

We collect the information you choose to provide in an email or other communication, together with the contact details needed to respond.

3. Why we use personal data

We use personal data to:

• calculate, display and save your Zest Check lifestyle pattern;
• personalise your result and provide related information or follow-up emails where you have consented;
• respond to enquiries and provide services you request;
• operate, secure, troubleshoot and improve the website and quiz;
• prevent abuse, duplicate automated submissions, fraud and security incidents;
• create aggregated or anonymised insights that no longer identify an individual; and
• comply with legal obligations and establish, exercise or defend legal rights.

We do not sell personal data. We do not use quiz answers for third-party advertising.

4. Consent and other permitted processing

We rely on your explicit consent to process the health-related answers submitted through Zest Check, personalise your result, and send related emails. You may withdraw that consent at any time by emailing office@zest.life. Withdrawal does not affect processing already carried out lawfully before your request.

Where applicable, we may also process limited personal data to take steps you request, perform an agreement with you, comply with UAE law, protect information security, or establish and defend legal rights, as permitted by applicable law.

The quiz is intended for adults. If you are under 18, please do not submit health-related information without the involvement and permission of a parent or legal guardian.

5. Automated scoring and profiling

Zest Check uses a rules-based calculation to compare the scores from your answers and assign the lifestyle pattern that most closely matches them. It may also display a general safety message based on selected answers. This is automated profiling, but it is not a medical diagnosis and is not used to make a decision that produces legal or similarly significant effects.

You may ask for an explanation, request human review, provide your point of view, or challenge a result by contacting office@zest.life.

6. Who may receive personal data

We limit access to people and organisations that need the information for the purposes described above. These may include:

• website hosting, database, security, backup and IT service providers;
• email and communications providers used to send requested or consented communications;
• professional advisers such as legal, compliance, accounting or insurance advisers;
• competent authorities where disclosure is required or permitted by law; and
• a successor in connection with a genuine reorganisation, merger or transfer of the business, subject to appropriate confidentiality and data-protection safeguards.

Service providers may process personal data only for the agreed purpose and under appropriate confidentiality, security and data-protection obligations.

7. Transfers outside the UAE

Some hosting, communications, security or support providers may process personal data outside the United Arab Emirates. Before such a transfer, we take steps required by applicable UAE law, which may include using a jurisdiction recognised as providing an adequate level of protection, contractual safeguards, explicit consent, or another legally permitted transfer mechanism.

You may contact us for information about the relevant destination categories and safeguards.

8. How long we keep personal data

We keep identifiable personal data only for as long as it is reasonably necessary for the purposes described in this notice. Quiz submissions are retained while needed to provide and support the result and consented follow-up, then deleted or anonymised when they are no longer necessary. We may retain limited information for longer where required by law, to document consent or withdrawal, resolve disputes, prevent abuse, or establish and defend legal rights.

Retention is reviewed with regard to the sensitivity of the data, the purpose for which it was collected, security and operational needs, and applicable legal requirements. You may request deletion at any time.

9. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These include encrypted connections, access controls, limited administrative access, protected storage, input validation, rate limiting, backups, and the use of a one-way IP identifier in the quiz database.

No online system can be guaranteed completely secure. If a personal-data breach creates a risk requiring notification, we will notify the UAE Data Office and affected individuals as required by applicable law.

10. Your rights

Subject to the conditions and exceptions in applicable UAE law, you may have the right to:

• receive information about the personal data we process, the purposes, recipients, retention criteria and cross-border safeguards;
• request access to and a copy of your personal data;
• request transfer of data in a structured, commonly used and machine-readable format where applicable;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• restrict or stop processing, or object to processing, in circumstances provided by law;
• withdraw consent at any time;
• request human review of automated processing and profiling; and
• complain to the UAE Data Office if you believe your personal data has been processed in breach of applicable law.

To exercise a right, email office@zest.life. Please describe your request and the email address used for the quiz or communication. We may request proportionate information to verify your identity before disclosing, changing or deleting data. We will respond in accordance with the timeframes and procedures required by applicable law.

11. Email communications

Where you have consented to related emails, you may withdraw that consent at any time by using the unsubscribe method provided in the communication or emailing office@zest.life. We may retain a minimal suppression record so that we can respect your opt-out.

12. Cookies and audience analytics

With your consent, we use Matomo, hosted on Zest’s own hosting account, to measure use of our public pages, library viewer and quiz landing page. We count library Download PDF button clicks using a named “Library download” event without a download URL or filename; this measures download requests, not confirmed completion of file transfers. We collect pageviews using generic page labels, an approximate country derived from your IP address, your browser language, browser and operating system, and device category. We use first-party analytics cookies to estimate unique and returning browsers. These estimates are not an exact count of individual people.

Matomo does not load or collect analytics until you select “Accept analytics”. The expanded collection of quiz page visits and library download clicks requires a renewed choice from visitors who accepted the previous version; previous rejections remain respected. You can reject analytics without losing access to the site and withdraw consent at any time using the “Analytics preferences” button. We also respect browser Do Not Track and Global Privacy Control signals. Your consent choice is stored for up to six months in the zest_analytics_consent preference cookie. Optional staff/testing exclusions use zest_analytics_internal for up to one year.

Analytics cookies beginning _zest_pk_ recognise a browser for up to six months, with a session cookie lasting approximately 30 minutes. Browser restrictions may shorten these periods. Rejecting analytics removes these analytics cookies. Preference cookies remain so we can respect your choice.

We do not send names, email addresses, quiz answers, quiz results or safety flags to Matomo. For the quiz, analytics counts the page load only: it does not record answers, question steps, submissions, results or safety flags. Private administration, finance and the analytics dashboard are excluded. Public library views use a generic resource label rather than a private link or document title. We do not collect age or gender, run session replay, or use Google Analytics or advertising trackers in this setup.

Country lookup takes place on our server using a locally stored geolocation database. Full IP addresses are used transiently for country lookup and traffic filtering; Matomo masks IP addresses before storage. Detailed Matomo data is retained for 90 days and aggregate reports for 13 months. Raw hosting access logs, which can include full IP addresses and requested URLs, are retained for 90 days for operations and security. These limits apply to the live analytics database. Restricted disaster-recovery backups may retain older copies and are not used for routine analytics.

Restricted services may use strictly necessary cookies for login, security and core functionality. Hosting providers create ordinary technical logs when resources are requested, including when analytics is rejected. Our public website and Zest Check do not use third-party behavioural advertising cookies.

Country lookup uses IP geolocation by DB-IP. Approximate country does not establish your nationality or residence.

13. Changes to this notice

We may update this notice when our services, providers or legal obligations change. The current version will be published at this address with a revised “Last updated” date. Where a change materially affects consent-based processing, we will seek new consent when required.

14. Contact and complaints

For questions, requests, consent withdrawal or complaints, contact:

Zest Life LLC-FZ
Meydan Free Zone, Dubai, United Arab Emirates
office@zest.life

If you are not satisfied with our response, you may submit a complaint to the UAE Data Office in accordance with its available procedures.