LEGAL
Your data, and your patients’ data.
Last updated July 27, 2026
This policy explains what farab does with information. It covers two very different things, and the difference matters: information about you when you visit this site or ask for a Leak Report, and information about your patients when you engage us and we operate follow-up systems on your behalf.
Section 02 sets out that distinction. If you are a practice deciding whether to work with us, read 02, 05 and 06 first.
01
farab is a Meta advertising and patient follow-up agency based in Doha, Qatar, working with dental practices in the US. For any question about this policy, or to exercise a right described in section 11, email [email protected] and we will reply within five business days.
02
Almost every complaint about agencies and data comes from blurring these. We keep them separate.
As a controller. When you visit this site, book a Leak Report call, or email us, we decide what happens to that information. This policy governs it.
As a processor. When you engage us as a client, we handle information about your patients inside advertising, messaging and CRM systems. We do not own that information and we do not decide what it is for. You do. We act only on your documented instructions, under the written agreement between us. Your own privacy notice, not this one, governs your patients.
Practical consequence: your patient list is never merged into any farab database, never used to build our own audiences, and never shared with another client. On termination it is exported to you in full and removed from our systems.
03
04
Once you engage us, the systems we build handle information your patients give you. Typically: name, phone, email, the treatment they inquired about, appointment times, message history, and whether they attended.
Some of this is protected health information under US law. Where that is the case and you are a covered entity, we act as a business associate and will sign a Business Associate Agreement before we touch a patient record. The BAA, not this policy, sets the terms.
05
06
When you give us a mobile number on a form, you agree that we may contact you about your request by phone, SMS or WhatsApp, including through automated systems and an AI voice agent that identifies itself as such. This is not a condition of buying anything. Message and data rates may apply. Reply STOP to end messages, HELP for help, or email us.
If you are a practice: consent to message your patients has to come from your patients, to you, at the point you collected their details. We will ask you to confirm in writing that it exists before any database campaign runs. Section 8 of the Terms of Service sets this out.
07
This site uses cookies to function, to measure traffic, and to measure our advertising. We run the Meta pixel and Google Analytics on this site.
This is a business-to-business site. The pixel here observes visits by practice owners and marketing staff to an agency website. It is not installed on any patient-facing page by us for this purpose, and it is not configured to send any health-related event, patient identifier or treatment interest to any advertising platform.
When you first arrive we show a cookie banner. The Meta pixel and Google Analytics do not load at all until you accept it. Choosing Decline leaves only the cookies needed to make the site work. You can change your mind at any time in section 11a, block or delete cookies in your browser, and opt out of interest-based advertising through your Meta and Google ad settings.
08
We do not sell your personal information. We share it only with providers who need it to run our business, and only for that purpose:
A current list of the specific providers we use is available on request.
09
We are based in Qatar and work with practices in the US. Information may therefore be stored or accessed in Qatar and the United States, whose data protection laws differ from one another.
Where we move personal information out of a region that restricts transfers, we rely on the appropriate safeguard for that region, including standard contractual clauses. Ask us and we will tell you which applies to you.
10
11
Wherever you are, you can ask us to give you a copy of what we hold, correct it, delete it, or stop using it for marketing. Email us and we will act without undue delay.
If you are in California, you also have the right to know the categories collected and disclosed, to delete, to correct, to opt out of sale or sharing, and not to be discriminated against for exercising any of them. We do not sell personal information for money. We do disclose limited online identifiers, such as cookie and device identifiers, to Meta and Google so we can measure and target our own advertising. Under the CCPA that counts as “sharing” for cross-context behavioral advertising, so we tell you plainly rather than claim otherwise. You can stop it at any time using the choices in section 11a. Similar rights apply in Virginia, Colorado, Connecticut, Utah, Texas and other states with comparable laws. We have never sold or shared patient information under any of these laws, and we never will.
If you are in Qatar, you have the rights given by Law No. 13 of 2016 on Personal Data Privacy Protection.
We may need to verify who you are before acting. An authorised agent may act for you with written proof.
11a
This is our “do not sell or share my personal information” page. There are three ways to stop the sharing described in section 11. Any one of them is enough.
We will not treat you any differently, charge you more, or give you a worse service for exercising any of these choices.
12
We use individual accounts, two-factor authentication, encrypted transport, and access limited to the people who need it. Client and patient information is kept inside the client’s own tenant or a separated sub-account, not pooled.
No system is completely secure, so we do not promise absolute security. If a breach affects your information we will notify you, and any regulator we are required to notify, within the time the law allows.
13
Our site and services are for businesses. We do not knowingly collect information from anyone under 18 through this site. Where a practice’s systems contain information about minor patients, that information is handled under our agreement with the practice and its own consent processes, not through this site.
14
We may update this policy. The current version is always posted here with its date. If a change materially affects how we use information about you, we will tell you by email before it takes effect.
CONTACT US
Want to know what we hold on you, want it corrected, or want it removed? Email us and we’ll take care of it. If you are a practice and need our Business Associate Agreement or sub-processor list, ask and we’ll send both.
[email protected]