Certified on NPHIESThis notice is from [legal name], CR [number], [national address], Riyadh.
If you are a patient: your clinic decides what is kept about your visits. Ask them first; they can ask us.
In short
- We collect only what we need to run your clinic’s Nabdah account and to answer your requests.
- Patient records belong to your clinic. We keep them on the clinic’s behalf and use them for nothing else.
- We don’t sell personal data, and we don’t use it for advertising.
- You can ask what we hold about you, and have it corrected or deleted, by writing to our data protection officer.
[Counsel to confirm each point above]
What we collect, and why
| What | Why | How long | Where it is kept |
|---|---|---|---|
| Your name, mobile and clinic, from the demo form | To arrange your demo | [period] | [hosting region] |
| Messages you send us on WhatsApp | To answer you | [period] | [WhatsApp’s provider; counsel to assess the transfer] |
| Account details of your team | To run your clinic’s account and sign-in | [period] | [hosting region] |
| How the site is used | [Without cookies, if analytics stays cookieless] | [period] | [provider] |
[Counsel to complete: legal basis for each, and any further categories]
Patient records in Nabdah
[Counsel: the clinic is the controller of its patients’ data and Nabdah processes it on the clinic’s instructions, under the data processing agreement]
Who we share it with
[Counsel: NPHIES and insurers when a clinic sends a claim; ZATCA for invoices; named service providers, each under contract]
Where it is kept, and for how long
[Counsel and operations: the hosting region, backups included, confirmed in writing, and the retention periods]
Your rights
[Counsel: the rights under the Personal Data Protection Law, and how to use them]
Our data protection officer
Write to privacy@nabdah.ai. We reply within [period].
Changes to this notice
[Counsel: how changes are announced, and a dated list of them]