Privacy Policy

Qassim Health Cluster places the utmost importance on the privacy of visitors to its electronic portal and users of its digital services. This policy explains how we collect personal information, how it is used and protected, within the framework of regulations and legislation in force in the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) issued by Royal Decree No. (M/19).

By using this portal, you agree to the terms and conditions set forth in this document. We recommend reading it carefully; if you do not agree with any provision, please stop using the portal.

We may collect various types of data when you interact with our portals and digital services, including:

• Full name and national identity data when registering accounts or requesting health services.
• Contact information: email address, mobile number, postal address.
• Device data: IP address, browser type, operating system, pages visited.
• Health information you voluntarily provide when booking appointments or requesting consultations.
• Inquiries and messages sent through contact forms or official email.
• Aggregated and non-personal analytics data used to improve performance and user experience.

The data we collect is used exclusively for the following purposes:

• Providing electronic health services and completing requested procedures.
• Communicating with you regarding your appointments, requests, or inquiry responses.
• Sending relevant medical notifications and health alerts with your consent.
• Improving the quality of digital services and developing the portal.
• Fulfilling legal, regulatory and oversight requirements.
• Ensuring portal security and detecting any suspicious or fraudulent activity.
• Preparing aggregated and non-personal health reports and statistics.

We do not share your personal data with external parties except in the following specific and lawful cases:

• Ministry of Health: As Qassim Health Cluster is an affiliated entity, data is exchanged according to approved regulatory frameworks.
• Technology Service Providers: Technical partners entrusted with operating the digital infrastructure who are bound by data protection agreements.
• Legal Requirements: When required by law or ordered by competent judicial and security authorities.
• Medical Emergencies: To protect the patient's life or health when absolutely necessary.
• Referring Health Entities: When referring a case to another health facility with the patient's or guardian's consent.

We adopt a comprehensive set of technical and administrative security measures to protect your data, including:

• Data encryption in transit via HTTPS/TLS protocol.
• Applying ISO 27001 information security standards in the infrastructure.
• Restricting access to sensitive data to authorized personnel only with limited permissions.
• Conducting periodic security reviews and penetration tests to detect vulnerabilities.
• Maintaining and monitoring access logs to detect any unauthorized activity.
• Training human resources on information security policies and privacy protection.

However, no electronic transmission or digital storage is 100% secure. In the event of any breach affecting your data, we will promptly notify you in accordance with procedures stipulated by applicable regulations.

This portal uses cookies to improve your experience and ensure services work correctly. These cookies fall into the following categories:

• Essential cookies: Necessary for running the portal and managing sessions; they cannot be disabled.
• Analytics cookies: Help us understand how you use the portal to improve its performance.
• Preference cookies: Save your settings such as language and geographic region for a better experience.

Under the Saudi Personal Data Protection Law, you have the right to:

• Right of Access: Request access to the personal data we hold about you.
• Right of Rectification: Request correction of any inaccurate or incomplete data.
• Right of Erasure: Request deletion of your data in cases permitted by law.
• Right to Object: Object to the processing of your data for certain purposes.
• Right to Withdraw Consent: Withdraw your consent to data processing at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: Lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if unsatisfied.

To exercise any of these rights, please contact us through the official channels mentioned below. We will respond to your request within a maximum of 30 business days.

This portal does not directly target children under the age of thirteen (13). If a child submits personal data without their guardian's knowledge, we ask parents and guardians to contact us immediately to have this data deleted.

Health services related to children, such as vaccinations and growth records, are managed exclusively through the parent or legal guardian in accordance with approved health regulations.

Our portal may contain links directing you to external websites such as the Ministry of Health portal or other government platforms. Please note that this policy does not cover those external sites; we advise you to review the privacy policy of each site before providing any information.

We reserve the right to update this policy periodically to keep pace with legislative, technical or service developments. Any material updates will be published on this page with an indication of the date of the last amendment.

We recommend reviewing this page regularly. Continued use of the portal after updates are published constitutes implicit acceptance of the amended terms.

• First Edition: January 2024
• Second Edition: September 2024
• Current Edition (Third): May 2026

If you have any inquiry or request regarding this policy or your personal data, we are happy to be contacted through the following official channels: