Privacy policy

1Controller and processor

The clinic that opens an account is the controller of its patients' and staff's data and decides the purpose and basis of processing. Clouds Line for Information Technology is the processor that hosts and processes the data on the clinic's instructions under the data-processing agreement. For visitors to this site and for account and billing data, we are the controller.

2What data

Account data: the clinic's name, licence, VAT number, its users and billing. Patient data the clinic enters: identity and contact, appointments, the clinical record (charts, notes, photos, consents, prescriptions), insurance and billing data. Visitor data: what is sent in the contact form, and a language preference in one plain cookie.

3Purposes and basis

Providing the service to the clinic under the contract; meeting legal obligations (e-invoicing to the Zakat, Tax and Customs Authority, insurance transactions through NPHIES on the clinic's instruction, keeping the medical record for the statutory period); and any other purpose — marketing, photography, data sharing or research — needs a recorded consent from the data subject in the consent register with its purpose, source and date, and can be withdrawn.

4Inside the Kingdom

Data is stored and processed on servers inside the Kingdom of Saudi Arabia. Clinical photos and documents sit on a private disk that is never exposed on a public link. WhatsApp and SMS messages the system sends carry appointment and billing facts only — no diagnosis, no note, no photo.

5Who sees clinical data

Only the clinic's staff holding a clinical permission in its account. Every read of a clinical record is written to the access log with who, when and why, and the account owner can review it. Our staff reach a patient's data only on a documented support request from the clinic, and that access is logged too.

6Sharing and sub-processors

We do not sell data and do not share it for our own purposes. Data goes to a third party only when the clinic asks for it or the law requires it: the Zakat, Tax and Customs Authority (invoice data), NPHIES and the insurer (claim data on the clinic's instruction), messaging providers (the phone number and the appointment text), and the payment provider (the payment amount). Every sub-processor is named in the data-processing agreement.

7Retention

The medical record is kept for the period the Kingdom's health regulations require, e-invoice data for the period tax regulations require, and contact-form messages for twenty-four months. When an account closes, the data is exported to the clinic and then deleted after the export window, except what the law requires us to keep.

8Data-subject rights

A data subject has the right to be informed, to access their data and obtain a copy, to correct it, to have it destroyed when no law requires keeping it, and to withdraw consent. The request is made to the clinic as the controller, and the system gives it the tools to act: search, export, anonymisation and a record of the request and its effect.

9Security

Encryption in transit and at rest, permissions by role rather than by name, a log of every change, backups inside the Kingdom, and the separation of every clinic's data from every other in every query. Any incident affecting data is reported to the clinic and to the competent authority as the law requires.

10Cookies

This site uses no advertising trackers. One cookie remembers the language when you choose it, and the site works with no cookie at all. The product itself uses a session token for sign-in only.

11Contact

For any question or request about this policy write to Clouds Line for Information Technology from the contact page. This policy is updated when something changes, and the date of the last update appears above.

For any question about this page write to us from the contact page; we answer within a working day.