Privacy Notice

Notice Update

• We may at any time update the Privacy Notice and publish the new version on MMS’s site. It is your responsibility to check for any update and read the Privacy Notice on a regular basis.
• By using any of our services, including the Sites, Telehealth Services and Mobile Application, you expressly agree and consent to our use of your Data in accordance with this Privacy Notice.

What Personal Data Do We Collect?

We may collect:

• Identification data (e.g., name, national ID, passport)
• Contact information (e.g., phone number, email address)
• Health records and clinical data
• Insurance and billing data
• Usage data from digital services (IP address, browser type, etc.)

Why Do We Collect Your Data?

• Data is collected to:
• Deliver medical care and patient services
• Meet legal and regulatory obligations
• Administer billing and insurance
• Improve healthcare services and patient experience
• Conduct audits, analytics, and reporting
• To enhance MMS’s resources to better fit your experience

Legal Basis for Processing Personal Data

Our data processing is based on:

• Your explicit consent
• Legal obligations under healthcare regulations
• Public interest in healthcare
• Contractual necessity for service delivery
• Legitimate interests in system security and operational improvement

How Do We Store and Protect Your Data?

MMS applies strong technical and administrative controls:

• Data encryption at rest and in transit
• Role-based access control and multi-factor authentication
• Secure system environments with regular backups
• Physical access control to data centers and devices

Data Transfers Outside Saudi Arabia

Your personal data is stored within Saudi Arabia unless explicitly required otherwise. If transferred, safeguards such as Standard Contractual Clauses or regulatory approvals are applied to protect your data.

Who Has Access to Your Data?

Data may be accessed or shared with:

• Authorized MMS staff
• Health insurance companies
• Regulatory authorities
• Approved vendors under contract
• Emergency responders when necessary

Data Sharing with Third Parties

MMS may share personal data with:

• IT service providers for systems hosting or support
• Medical laboratories and imaging partners
• Accreditation bodies and regulators
• Legal advisors and auditors under confidentiality

Children's Privacy

We handle personal data of children under 18 with special care. Consent from a parent or legal guardian is obtained before processing any child-related data. We are committed to protecting the privacy needs of children and we encourage parents and guardians to take an active role in their children's online activities and interests.

Marketing Communications

We may contact you with updates, health alerts, or promotional materials without the use of your Sensitive Personal Information. You can opt out at any time by following the unsubscribe instructions or contacting privacy@mouwasat.com.

Cookies and Tracking Technologies

Our digital platforms use cookies to enhance functionality and analyze traffic. You may manage cookie preferences through your browser settings.

You have the right to:

• Know how your data is used
• Request access, correction, or deletion
• Withdraw consent (where applicable)
• Object to processing
• Lodge complaints with the Data Protection Officer
• MMS notifies data owners of their right to access an exact copy of their stored personal data.

Retention and Disposal

Mouwasat Medical Services retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations. Once the retention period has ended, data is securely deleted or anonymized in accordance with approved policies to prevent unauthorized access or unlawful use.

Methods of Data Collection

Personal data is collected through various channels including registration forms, MMS mobile applications, hospital websites, cookies, patient portals, and service request systems.

Data Subject Request Processing Timeframes

Requests for data access, correction, or deletion will be processed within 7 business days of receipt, in accordance with regulatory obligations.

Data Sharing Consent

MMS does not share or exchange personal data with any third party without a lawful basis and explicit consent from the data subject, unless legally mandated.

External Links Disclaimer

MMS websites may include links to external sites. We are not responsible for the privacy practices or content of these external websites.

Contacting the Data Protection Officer

For privacy inquiries, please contact the MMS Data Protection Officer via email at: privacy@mouwasat.com

Complaints and Escalation

If you believe your personal data has been mishandled, you may file a complaint through privacy@mouwasat.com