Privacy Policy — Alij Healthcare Platform
Last updated: 30 October 2026
This Policy explains how Alij Healthcare Company, Commercial Registration No. 404050654, based in Jeddah, Kingdom of Saudi Arabia, handles personal data associated with the use of Alij Healthcare Platform.
It applies to representatives, employees and users of registered organizations, beneficiaries, and others whose data is processed as part of the Platform’s services, whether collected directly from them or provided by an authorized organization.
1. Responsibility for Data Protection
The Company fulfills its statutory responsibilities for personal data according to the nature of each activity. It may act as a controller when it determines the purposes and means of processing, or as a processor when processing data for and on behalf of another organization, depending on the activity and the relationship between the parties.
Each Organization is responsible for its independent collection, use or sharing of data and must have the necessary legal basis when providing data to the Platform. Where the Company processes data on behalf of another organization, the purposes, scope and parties’ responsibilities are governed by agreements, documented instructions and applicable law.
This Policy does not relieve registered organizations of their duties to data subjects or of the requirement to provide privacy notices and obtain the necessary consents or meet other statutory requirements.
2. Data We May Process
Depending on the relationship and service, data may include:
- Organization representative and user data: names, job titles, contact details, authorization letters, account information and permissions, and information necessary to verify a user’s capacity and authority.
- Beneficiary data: identification, contact and eligibility information, and health or treatment information needed to provide and monitor services.
- Transaction data and electronic records: requests, offers, consents, approvals, correspondence, notices, notes, documents and records of actions taken through the Platform.
- Financial data: bank account details, invoices, claims, payments and supporting evidence, where these contain personal data.
- Usage and security data: login and activity records and information necessary to operate the Platform, protect accounts and verify actions.
We limit data to what is appropriate and necessary for the purpose. Health data and other sensitive data are subject to the specific statutory safeguards that apply to them.
3. Data Sources
We may obtain data directly from the individual, from the Organization they represent, from nonprofit organizations, healthcare service and product providers or other parties authorized to handle their data, or from other sources permitted by law.
An Organization providing another person’s data must verify that it may lawfully do so, give them the necessary information and obtain the required consent or establish another legal basis for processing.
4. Purposes of Processing
We use data as needed to:
- Verify organizations, their representatives and authorizations, and manage accounts and permissions.
- Organize and coordinate healthcare services and products, enable transactions and monitor delivery.
- Enable the relevant organizations to assess beneficiary cases and make decisions and approvals within their responsibilities.
- Document requests, consents, approvals, transactions, claims, invoices and financial settlements.
- Evidence electronic actions, verify authority and protect the integrity of dealings.
- Communicate about accounts, services, complaints and objections.
- Protect beneficiaries and accounts and prevent misuse and fraud.
- Meet statutory and contractual requirements, protect rights and address disputes.
- Produce reports and indicators, improve services and measure performance and impact, using aggregated or anonymized data where possible.
We do not use data for a new purpose incompatible with its original purpose without meeting the necessary statutory requirements.
5. Legal Basis for Processing
Processing relies on the legal basis appropriate to each purpose, including consent where required, performance of an agreement to which the data subject is a party, compliance with a statutory obligation, or another basis permitted by law.
An Organization representative’s acceptance of this Policy does not constitute consent on behalf of all beneficiaries to every processing activity and does not replace the requirements specific to health or sensitive data.
Where processing relies on consent, that consent is specific and clear and may be withdrawn in accordance with statutory rules.
The specific statutory requirements and safeguards for health and other sensitive data are observed when processing such data.
6. Data Sharing and Disclosure
Where necessary and permitted, data may be shared with:
- The user’s Organization and its authorized users.
- Nonprofit organizations, healthcare service and product providers, funding and support partners, and other parties connected with the relevant service or transaction, within their needs and assigned permissions.
- Supporting service providers, such as hosting, technical support, notifications, email and telephone messaging providers.
- Professional advisers and auditors where needed, subject to confidentiality.
- Judicial, regulatory and other competent authorities where there is a legal basis.
Sharing is limited to those who need access and to the minimum necessary for the purpose. Registration on the Platform alone does not entitle an Organization to access beneficiary data.
We do not sell personal data or permit its use for independent marketing except in accordance with statutory requirements and the necessary consent where required.
7. Hosting and Data Transfers
Data is hosted and processed under the Company’s approved hosting and service provider arrangements, in compliance with relevant statutory requirements.
Personal data is not transferred outside the Kingdom, or made accessible from outside it, unless the applicable statutory requirements have been met, the transfer is lawful and the necessary safeguards are in place.
8. Retention and Disposal
We retain personal data for as long as necessary to fulfill the purposes for which it was collected, meet statutory or contractual obligations, protect rights and address claims and disputes.
As a general rule, Organization account and transaction records are retained for two years after the relationship ends or the last related obligation is closed, whichever is later. A longer period may apply to records or documents subject to a longer statutory retention requirement, or where ongoing claims or disputes require it.
Retention periods for health and beneficiary data are determined by the processing purpose and applicable statutory requirements. Retention is not extended without a legitimate need or basis.
When the retention purpose has ended and there is no legal basis for continued retention, data is securely destroyed or identifying elements are removed so that it can no longer be attributed to individuals, in accordance with applicable law and approved procedures.
9. Data Security and Confidentiality
We adopt organizational and technical measures appropriate to the nature of the data and the risks of processing to limit unauthorized access, use, disclosure, alteration or loss.
Access is restricted according to roles and permissions. Authorized individuals and service providers are subject to appropriate confidentiality and security obligations.
Registered organizations and users must notify the Company without delay of any actual or suspected incident affecting the security or confidentiality of data connected with Platform use and cooperate in providing information needed to investigate and address its effects.
If a personal data incident occurs, we take the necessary steps to address it and limit its effects, and notify the competent authorities and data subjects where required by law.
10. Data Subject Rights
Subject to statutory conditions and exceptions, individuals have the right to:
- Be informed about how their data is collected and processed and for what purposes.
- Access their data and request a copy.
- Request correction, completion or updating of inaccurate data.
- Request destruction of data that is no longer lawfully needed.
- Withdraw consent where it is the basis for processing.
- Submit a complaint or objection about the handling of their data.
Withdrawing consent does not affect the lawfulness of earlier processing. Some services may no longer be available if they require necessary data or processing for which there is no alternative legal basis.
A destruction request will not be fulfilled in a way that breaches a statutory retention duty or prejudices rights that must be preserved. Where appropriate, the individual will be told why a request cannot be met in full or in part.
11. Requests and Complaints
Requests to exercise rights, enquiries and privacy complaints may be submitted to the Company’s Personal Data Protection Officer at:
We may request appropriate information to verify identity or authority before responding, limited to what is necessary to protect data and verify the request. Requests are handled within the statutory time limits.
If a request concerns data processed independently by a registered organization, we will cooperate in directing it to the appropriate party according to its responsibilities, without affecting the individual’s right to approach the competent supervisory authority.
12. Minors and Persons with Limited Legal Capacity
When handling data relating to a minor or a person with limited legal capacity, the relevant Organization must meet the requirements for guardianship or legal representation and necessary consent, and provide information in an appropriate form.
Such data must not be used outside the lawful purpose for which it was collected or in a way that harms the beneficiary’s interests or rights.
13. Notifications and Messages
We may use contact details to send notices about accounts, services, transactions or existing obligations by email, telephone messages or other designated communication channels.
Message content is limited to what is appropriate for its nature and delivery channel, with due regard to the confidentiality of health information. Marketing messages, if any, are subject to consent, statutory requirements and an option to opt out.
14. Cookies and External Services
The Platform may use cookies and similar technologies necessary to operate it, maintain sessions and preferences and protect it. Consent is requested for non-essential technologies where required by law.
When using an external service, its privacy policy should be reviewed. Engaging an external service provider does not relieve the Company of its obligations for data processed under its responsibility.
15. Policy Updates
This Policy may be updated to reflect statutory or operational changes. The revised version and its effective date will be published.
We notify the relevant individuals of material changes through appropriate channels and obtain renewed consent where required. An update does not constitute unrestricted permission to expand data use.
16. Authoritative Language
This Policy is issued in Arabic, which is the authoritative version for interpretation.
A translation into another language may be provided for convenience. If there is a difference in meaning or interpretation, the Arabic text prevails to the extent permitted by applicable law.