This Privacy Policy explains how Meena Health (“Meena”, “we”, “us”, or “our”) collects, uses, processes, stores, protects, and discloses Personal Data of patients, customers, visitors, users of our website, mobile applications, and other services.
We are committed to protecting Personal Data and ensuring that its processing is carried out in accordance with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulation, and applicable regulatory requirements issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).
By using our website, applications, or services, you acknowledge that you have read and understood this Privacy Policy.
1. Information We Collect
We may collect and process different categories of Personal Data depending on the services you use and your interactions with Meena.
This may include:
Identification and contact information, such as name, identification number, address, telephone number, and email address.
Patient and Health Data relating to your health condition, medical history, diagnosis, treatment, appointments, and healthcare services received.
Information provided when creating or using an account or requesting our services.
Technical and usage information relating to your use of our website, applications, and digital services.
Information required to process requests, communications, appointments, and healthcare services.
Information provided through forms, communications, customer service channels, or other approved communication channels.
We collect only the Personal Data that is necessary for specified, explicit, and legitimate purposes.
2. How We Use Personal Data
We may process Personal Data for the following purposes:
Providing healthcare services and managing patient care.
Managing appointments, consultations, and related healthcare services.
Communicating with patients, customers, and users.
Responding to enquiries, requests, and complaints.
Maintaining and improving our healthcare services, applications, and digital platforms.
Protecting the security of our systems and information.
Managing and monitoring access to information.
Meeting legal, regulatory, contractual, and healthcare requirements.
Conducting audits, assessments, monitoring, and compliance activities.
Managing information security incidents and Personal Data Breaches.
Fulfilling other purposes that are permitted under applicable laws and regulations.
3. Legal Basis for Processing
Personal Data is processed only where there is a valid legal basis under the PDPL and its Implementing Regulation.
Depending on the circumstances, the legal basis may include the Data Subject's consent or another lawful basis permitted under the PDPL, including circumstances related to legal or regulatory obligations, protection of vital interests, or legitimate interests where applicable.
Where processing is based on consent, consent will be obtained in a clear and appropriate manner, and Data Subjects may withdraw their consent through an appropriate channel, subject to applicable legal requirements.
4. Data Protection and Security
We implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, unlawful processing, accidental loss, destruction, alteration, or disclosure.
These measures may include:
Access controls based on business need and the principle of least privilege.
Authentication and access management.
Encryption and secure storage where applicable.
Monitoring and audit trails.
Security assessments and controls.
Regular awareness and data protection training.
Incident and Personal Data Breach management procedures.
Although we take appropriate measures to protect Personal Data, no electronic transmission or storage system can be guaranteed to be completely secure.
5. Health Data
Health Data is treated as Sensitive Data and is subject to additional protection measures.
Health Data may include information relating to an individual's physical, mental, or psychological health condition and healthcare services received.
Access to Health Data is restricted to authorized personnel based on business need. Additional safeguards may be applied, including enhanced security controls and Data Protection Impact Assessments (DPIAs) where required.
6. Sharing and Disclosure of Personal Data
We may disclose or provide access to Personal Data where necessary and permitted under applicable laws and regulations.
This may include sharing with:
Authorized employees and healthcare professionals who require access to provide services.
Service providers, processors, vendors, and contractors acting on our behalf.
Regulatory or government authorities where legally required.
Other parties where disclosure is necessary to comply with legal or regulatory obligations or to protect our rights, safety, or the rights and safety of others.
Where third parties process Personal Data on our behalf, appropriate data protection and security requirements are applied.
7. Third-Party Service Providers
Before granting a third-party processor or vendor access to Personal Data, appropriate due diligence and data protection assessments may be conducted.
Where applicable, contractual arrangements and Data Processing Agreements are established to define the permitted processing, confidentiality, security requirements, and responsibilities of the parties.
8. Cross-Border Transfer
Personal Data will not be transferred or disclosed outside the Kingdom of Saudi Arabia except in accordance with the PDPL, its Implementing Regulation, and applicable regulations governing the transfer of Personal Data outside the Kingdom.
Where required, appropriate assessment and safeguards will be implemented before any Cross-Border Transfer.
9. Data Retention and Disposal
Personal Data is retained only for the period necessary to fulfill the purpose for which it was collected or as required by applicable legal, regulatory, healthcare, or contractual requirements.
When Personal Data is no longer required, it will be securely destroyed or anonymized in accordance with applicable requirements and approved procedures.
10. Your Data Subject Rights
Subject to the applicable requirements and limitations under the PDPL and its Implementing Regulation, Data Subjects may have rights relating to their Personal Data, including applicable rights to:
Request access to their Personal Data.
Request correction or completion of inaccurate or incomplete Personal Data.
Request destruction or deletion where legally applicable.
Exercise other rights provided under the PDPL and its Implementing Regulation.
Submit complaints or requests through approved communication channels.
Requests may be subject to identity verification and applicable legal or regulatory requirements.
11. Privacy Notices and Transparency
Meena maintains appropriate Privacy Notices describing relevant information about the processing of Personal Data, including the categories of data collected, purposes and legal basis of processing, retention periods, recipients or categories of recipients, and applicable Data Subject rights.
Privacy information is made available through appropriate official channels and is reviewed and updated when processing purposes or applicable legal requirements change.
12. Cookies and Technical Information
Our digital platforms may use common technical technologies to operate, secure, maintain, and improve our services.
Technical and usage information may include information such as IP address, date and time of access, device or browser information, and usage information.
Where cookies or similar technologies are used, they will be managed in accordance with applicable requirements.
13. External Links
Our website or applications may contain links to third-party websites or services.
This Privacy Policy applies to Meena's services and does not govern the privacy practices of third-party websites or services. Users should review the privacy policies of those third parties before providing Personal Data.
14. Personal Data Breaches
We maintain procedures for identifying, assessing, documenting, managing, and reporting Personal Data Breaches.
Where required under applicable laws and regulations, Meena will notify the competent authority and affected Data Subjects within the applicable requirements and timeframes.
15. Data Protection Officer
Meena designates a Data Protection Officer or equivalent function to oversee compliance with the PDPL and its Implementing Regulation and to support communication with the competent authority and Data Subjects.
The DPO or responsible function may support activities including compliance monitoring, Data Subject Rights requests, Data Protection Impact Assessments, Personal Data Breach management, and privacy awareness.
16. Privacy by Design and DPIA
Privacy and data protection principles are considered when planning, developing, or materially changing systems, services, and processes that involve Personal Data.
A Data Protection Impact Assessment (DPIA) may be conducted before high-risk processing activities, including activities involving large-scale Sensitive or Health Data processing, new technologies, or Cross-Border Transfers, where required.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our processing activities, services, applicable laws, regulations, or regulatory requirements.
The updated version will be made available through our official channels.
18. Contact Us
If you have any questions, requests, complaints, or concerns regarding the processing of your Personal Data or this Privacy Policy, you may contact us through our approved communication channels:
Email: [email protected]
Phone: 8003020200
Email: [email protected]
We will review and handle Personal Data requests in accordance with applicable laws, regulations, and organizational procedures.