Privacy Policy

1. Introduction

Mouwasat Medical Services Company ("Mouwasat") is a healthcare services provider in the Kingdom of Saudi Arabia, providing healthcare services through its hospitals, healthcare facilities, and digital channels. Its services include medical, diagnostic, therapeutic, and related healthcare and administrative services for patients, visitors seeking care, and beneficiaries of its services.

Mouwasat is committed to protecting the privacy, confidentiality, and security of the personal data it collects and processes in its capacity as a Controller, in accordance with the Personal Data Protection Law, its Implementing Regulations, and other applicable laws, regulations, and regulatory requirements in the Kingdom of Saudi Arabia.

This Privacy policy explains how personal data relating to individuals within the scope of this policy is collected, used, processed, retained, and shared; the purposes for which such data is processed; the legal bases for processing; the parties to whom data may be disclosed; as well as the rights of Personal Data Subjects, how those rights may be exercised, and how to contact Mouwasat regarding personal data protection.

By accessing or using Mouwasat services, you acknowledge that you have read and understood this Privacy policy and that you are aware of, and accept, the practices for collecting, using, processing, and sharing your personal data described herein, to the extent permitted by the legal bases set out under the Personal Data Protection Law.

2. Updates to this Privacy policy

Mouwasat may update this Privacy policy from time to time to reflect legal or regulatory requirements or changes in its personal data processing practices. The updated version will be published through the appropriate Mouwasat channels. You are encouraged to review this Privacy policy periodically for any updates or changes.

The privacy policy was last updated on October 1st, 2026.

3. Scope

This Privacy policy applies to individuals whose personal data is collected or processed by Mouwasat in connection with the provision of its services or its dealings with them, including, as applicable:

• Patients, visitors seeking care, and beneficiaries of healthcare or administrative services provided by Mouwasat.
• Parents, guardians, legal representatives, and patient companions where their personal data is collected in connection with the provision of services.
• Users of Mouwasat websites, applications, platforms, and digital services.
• Visitors and other individuals whose personal data is collected when interacting with Mouwasat facilities or services.
• Job applicants to Mouwasat.
• Suppliers, service providers, and individuals whose personal data is collected in the course of commercial or contractual dealings with Mouwasat.

This policy covers personal data collected or processed by Mouwasat directly or indirectly and through relevant physical, electronic, or digital channels and systems.

This policy does not apply to Mouwasat employees, whose personal data is governed by the Employee Privacy policy.

4. Controller and Contact Information

The Data Management Office and the Personal Data Protection Officer may be contacted for inquiries relating to the processing of personal data or to exercise rights granted under the Personal Data Protection Law.

5. Categories of Personal Data

Mouwasat may collect and process different categories of personal data depending on the nature of the relationship, the service provided, and the purpose of processing. These may include:

• Identity and identification data, such as name, National ID or Iqama number, passport number, date of birth, and nationality.
• Contact data, such as telephone number, email address, and address.
• Health and medical data, such as medical records, medical history, diagnoses, examination and laboratory results, imaging, medications, allergies, and medical services and procedures provided.
• Insurance, financial, and billing data, such as insurance information, claims, and billing and payment data related to services provided.
• Appointment and service data, such as booking information, appointments, referrals, and services requested or provided.
• Digital and technical data, such as Internet Protocol (IP) address, device and browser information, and usage logs relating to Mouwasat websites, applications, and digital platforms.
• Job applicant data, such as CVs, academic qualifications, professional experience, contact information, and other information submitted in connection with an employment application.
• Any other personal data collected according to the nature of the service or interaction with Mouwasat and in accordance with the relevant purposes and legal bases.

6. Mandatory and Optional Personal Data

The personal data required may vary depending on the nature of the service or interaction with Mouwasat. The provision of certain personal data may be mandatory or necessary to provide requested services or comply with applicable legal and regulatory requirements, while the provision of other data may be optional.

If necessary or required personal data is not provided, Mouwasat may be unable to provide certain services or complete certain related procedures or requests.

7. Purposes of Collecting and Processing Personal Data

Mouwasat collects and processes personal data, depending on the nature of the relationship and the service provided, for the following purposes:

• Providing healthcare, diagnosis, treatment, and medical follow-up services.
• Creating, managing, and retaining medical records and managing clinical operations.
• Managing appointments, registration, and communications with patients and beneficiaries concerning services provided.
• Managing insurance, claims, billing, payments, and related financial operations.
• Complying with legal and regulatory obligations and requirements of competent authorities.
• Ensuring patient safety and responding to medical and emergency situations.
• Improving the quality of services, healthcare, and beneficiary experience.
• Conducting audits and reviews, preparing reports, measuring performance, and assuring quality.
• Operating, managing, and protecting Mouwasat websites, applications, platforms, and digital services.
• Supporting and conducting medical and scientific research and studies in accordance with applicable legal requirements.
• Managing job applications, evaluating applicants, and communicating with them regarding employment opportunities and procedures.
• Managing dealings with suppliers, service providers, and related parties.
• Communicating for direct marketing purposes and sending offers and promotional materials relating to Mouwasat services, in accordance with applicable direct marketing requirements.
• Any other purposes connected with the nature of the services or dealings where compatible with the purposes for which the data was collected and permitted under applicable legal requirements.

8. Methods and Sources of Collecting Personal Data

Al-Mowasat may collect personal data in various ways and from various sources:

8.1 Sources of personal data collection:

• Directly from the Data Subject when registering, requesting or receiving services, or communicating with Mouwasat.
• From parents, guardians, legal representatives, or authorized persons, as applicable.
• From Mouwasat medical record systems and other systems and platforms.
• From Mouwasat websites, applications, patient portals, telemedicine services, and other digital channels.
• From insurance companies, healthcare providers, laboratories, and other parties involved in providing the service.
• From government and regulatory authorities or systems and platforms connected to them, where legally permitted.
• Directly from job applicants or through recruitment channels and platforms used for this purpose.
• From cookies and digital technologies used on websites and applications.
• From any other lawful sources permitted under applicable legal requirements.

8.2 Collecting personal data from a source other than the data subject or processing it for another purpose:

Generally, Mouwasat collects personal data directly from the Data Subject and processes it for the purposes for which it was collected. Where it is necessary to collect personal data from other sources or process it for another purpose, such processing will be carried out in accordance with the Personal Data Protection Law and its Implementing Regulations, based on an appropriate legal basis, and with the necessary procedures and notices in accordance with applicable legal requirements.

Cases in which the law may permit this include:

• Where the Data Subject has consented in accordance with the law.
• Where the personal data is publicly available or has been lawfully collected from a publicly available source.
• Where adhering to direct collection from the Data Subject or to the original purpose may cause harm to the Data Subject or affect their vital interests.
• Where collection or processing is necessary to protect public health or public safety, or to protect the life or health of a specific individual or individuals.
• Where the personal data will not be recorded or retained in a form that makes it possible to identify the Data Subject directly or indirectly, in accordance with applicable anonymization requirements.
• Where collection or processing is necessary to achieve Mouwasat’s legitimate interests, provided that this does not prejudice the rights of the Data Subject or conflict with their interests and that the data being processed is not Sensitive Data.
• Any other cases permitted by applicable laws and regulations.

9. Legal Bases for Processing Personal Data

Mouwasat collects and processes personal data based on the legal bases established under the Personal Data Protection Law, depending on the nature and purpose of the processing. These include:

• Performance of an agreement to which the Data Subject is a party: for processing necessary to provide healthcare, medical, and related administrative services and to fulfil obligations arising from the provision of those services.
• Processing pursuant to another law: to comply with legal and regulatory obligations applicable to Mouwasat as a healthcare provider, including requirements and controls issued by relevant competent authorities.
• Consent of the Data Subject: where consent is the appropriate legal basis for the processing.
• Achieving a realized interest for the Data Subject: where contacting the Data Subject is impossible or difficult, as permitted by law.
• Legitimate interests of Mouwasat: where the processing meets the applicable legal requirements and conditions, provided that the processing does not involve Sensitive Data.

Mouwasat may also rely on any other legal basis permitted by applicable laws and regulations, depending on the nature and purpose of the processing.

10. Rights of the Data Subject and How to Exercise Them

The Data Subject has the rights provided under the Personal Data Protection Law and its Implementing Regulations, subject to applicable legal requirements and conditions, including:

• Right to be informed: including the right to be informed of the legal basis and purpose for collecting and processing personal data.
• Right of access to personal data: the Data Subject may access their personal data held by Mouwasat in accordance with applicable legal requirements.
• Right to request a copy of personal data: the Data Subject may request a copy of their personal data held by Mouwasat in a readable and clear format, in accordance with applicable legal requirements.
• Right to request correction, completion, or updating: the Data Subject may request correction of inaccurate personal data, completion of incomplete data, or updating of outdated data.
• Right to request destruction: the Data Subject may request destruction of their personal data in cases permitted by law, subject to any legal requirements requiring its retention.
• Right to withdraw consent: where processing is based on consent, the Data Subject may withdraw consent in accordance with applicable legal requirements. Withdrawal does not affect the lawfulness of processing carried out before consent is withdrawn.
• Right to claim compensation: the Data Subject has the right to claim compensation for material or moral damage suffered as a result of a violation of the Personal Data Protection Law or its Implementing Regulations before the competent judicial authority, in accordance with applicable legal procedures.

The Data Subject may exercise these rights by contacting the Data Management Office at privacy@mouwasat.com.

Mouwasat will take appropriate measures to verify the identity of the requester before fulfilling a request where necessary to protect personal data and confirm the requester’s entitlement.

Requests to exercise rights will be handled and responded to without delay and within a period not exceeding thirty (30) days from receipt of the request. This period may be extended for an additional period not exceeding thirty (30) days in cases permitted by applicable legal requirements, provided that the Data Subject is notified in advance of the extension and the reasons for it.

11. Protection, storage, and destruction of personal data

11.1 Storage and Protection of Personal Data

Personal data processed through Mouwasat’s core systems, including medical data and medical records, is stored on systems and technical infrastructure located within the Kingdom of Saudi Arabia.

Where services or technical systems require personal data to be processed or stored outside the Kingdom, such processing or storage will be carried out in accordance with applicable legal requirements governing the transfer of personal data outside the Kingdom.

Mouwasat implements appropriate organizational, administrative, and technical measures to protect personal data and maintain its confidentiality and integrity, and to reduce the risks of unauthorized access, use, disclosure, alteration, loss, or destruction.

Appropriate security controls and procedures are applied according to the nature of the data and the level of risk associated with its processing, in accordance with applicable legal and regulatory requirements and relevant cybersecurity standards and controls.

11.2 Retention and Destruction of Personal Data

Mouwasat retains personal data for the period necessary to achieve the purposes for which it was collected or processed, in accordance with Mouwasat’s approved retention policies and periods, or for the period required by applicable laws, regulations, regulatory requirements, and approved medical practices, depending on the nature of the data and the purpose of processing.

The retention period for personal data is determined based on the nature and sensitivity of the data, the purpose for which it is used and processed, and applicable legal and regulatory requirements.

Mouwasat may retain certain personal data for a longer period where required on a legal basis, or for purposes of evidencing transactions, defending rights and claims, or dealing with relevant judicial or regulatory proceedings.

When the purpose and legal requirements for retaining personal data have ended, the data will be securely destroyed in a manner that prevents access to or recovery of the data or identifying elements will be removed where continued retention is legally permitted, in accordance with Mouwasat’s approved policies and procedures.

12. Personal Data Minimization

Mouwasat is committed to collecting and processing personal data that is adequate and directly relevant to the specified purposes of processing and limited to the minimum necessary to achieve those purposes and seeks to avoid collecting or processing unnecessary personal data.

13. Transfer of Personal Data Outside the Kingdom

Mouwasat endeavors to process and retain personal data within the Kingdom of Saudi Arabia where appropriate and in accordance with applicable legal requirements.

Where necessary, Mouwasat may transfer personal data outside the Kingdom of Saudi Arabia or disclose it to parties located outside the Kingdom, including in connection with certain specialized medical, diagnostic, or laboratory services, in accordance with the Personal Data Protection Law, the Regulation on Personal Data Transfer outside the Kingdom, and other applicable legal requirements.

Mouwasat applies the appropriate legally prescribed procedures and safeguards to protect personal data when it is transferred or disclosed outside the Kingdom and seeks to limit the data transferred to what is necessary to achieve the purpose of the transfer, in accordance with applicable legal requirements.

14. Sharing and Disclosure of Personal Data

Mouwasat may share or disclose personal data, as necessary and depending on the nature of the service and the purpose of processing, to relevant parties, including:

• Healthcare providers, laboratories, medical centers, and parties involved in providing healthcare services: to provide or complete medical, diagnostic, therapeutic, and related healthcare services.
• Insurance companies and parties involved in claims and insurance coverage: to verify insurance coverage and manage approvals, claims, billing, and related operations.
• Government, regulatory, judicial, and other competent authorities: to comply with legal and regulatory obligations and requirements, or in response to requests and orders issued by competent authorities, where disclosure is required or permitted by law.
• Service providers, suppliers, and contractors that provide services to Mouwasat or process personal data on its behalf: to provide, operate, and support relevant services, systems, and operations according to the nature of the contracted services.
• Other parties: where disclosure is necessary to achieve a lawful purpose connected with the services provided or is required or permitted under applicable laws, regulations, and legal requirements.

Personal data may be disclosed as needed or on a periodic basis, depending on the nature of the service and the purpose of disclosure.

Personal data is disclosed based on an appropriate legal basis, and the consent of the Data Subject will be obtained where consent is legally required. Disclosure will be limited to the amount of data necessary to achieve its purpose, and appropriate measures will be taken to maintain the privacy and protection of the data.

15. Access to Personal Data

Access to personal data is limited to authorized employees, personnel, and parties whose duties or responsibilities require access, and only to the extent necessary to achieve the purpose of processing and providing the relevant services.

Mouwasat applies appropriate controls and procedures for managing access to personal data, taking into account the nature and sensitivity of the data and business requirements, in accordance with applicable legal and regulatory requirements.

For health data and medical records, Mouwasat seeks to limit access and processing to the minimum number of employees and personnel necessary to provide healthcare services or perform authorized duties in accordance with applicable legal requirements.

16. Personal Data Breaches

In the event of a personal data breach, damage, or unauthorized access, Mouwasat will take the necessary measures to manage the incident, limit its effects, and address the associated risks in accordance with applicable legal and regulatory requirements.

Mouwasat will notify the competent authority of personal data breaches where the applicable notification criteria are met. Affected Personal Data Subjects will also be notified where the incident may result in harm to their data or conflict with their rights or interests, in accordance with applicable legal requirements.

17. Processing Personal Data of Children and Persons with Limited or No Legal Capacity

Mouwasat may collect and process personal data relating to children and persons with limited or no legal capacity in connection with the provision of healthcare, medical, and other related services, in accordance with applicable laws, regulations, and legal requirements.

Where the consent of a legal guardian is required for processing personal data, Mouwasat will take appropriate measures to verify the validity of the legal guardianship, while taking into account the rights and interests of the Personal Data Subject.

A legal guardian may exercise the rights granted to the Data Subject on their behalf in accordance with applicable legal requirements, and a Personal Data Subject with limited legal capacity will be enabled to exercise their rights once they attain full legal capacity.

18. Cookies and Similar Technologies

Mouwasat websites, applications, and digital platforms may use cookies and similar technologies to enable and operate digital services, improve their performance and user experience, understand how services are used, and achieve other purposes permitted by law.

Cookies and similar technologies, and the data generated through them, are used and processed in accordance with applicable legal requirements. Users may manage cookies through browser settings or options made available through Mouwasat digital channels, as applicable.

19. Service Communications and Direct Marketing

Mouwasat may communicate with patients and beneficiaries to send notices and messages relating to services provided, such as appointment confirmations and reminders, administrative notices, and other service-related communications, in accordance with the relevant legal bases.

Mouwasat may also use contact data to send offers and marketing or promotional materials relating to its services, in accordance with applicable direct marketing requirements.

Mouwasat does not use Sensitive Data, including health data, for direct marketing purposes.

The Data Subject may opt out of receiving marketing messages using the mechanisms available in the messages or through channels provided by Mouwasat for this purpose, in accordance with applicable legal requirements.

20. External Links and Websites

Mouwasat websites, applications, or digital platforms may contain links to websites or electronic services operated by other parties. Processing of personal data when using those websites or services is subject to the privacy policies and practices of their respective operators.

Mouwasat is not responsible for the privacy practices or content of external websites or services that are not under its management or control. Individuals are encouraged to review the privacy policy or policies of those parties before providing them with any personal data.

21. Personal Data Complaints and Inquiries

Personal Data Subjects may submit inquiries or complaints relating to the processing of their personal data or the exercise of their rights by contacting the Data Management Office at privacy@mouwasat.com.

Mouwasat will handle and respond to personal data protection complaints and inquiries within an appropriate period and in accordance with applicable procedures, timeframes, and legal requirements.

If the Data Subject is dissatisfied with the handling of their complaint, or in cases permitted by law, they may submit a complaint to the Saudi Data & Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform, in accordance with applicable procedures and legal requirements.

Version: V.1.1