Privacy Policy

Privacy Notice

1- Purpose

National Medical Care Company, its branches, and its subsidiaries is a healthcare provider in the Kingdom of Saudi Arabia.

This Privacy Notice informs about how National Medical Care Company, its branches, and its subsidiaries, as the controller of user's personal data, manages, protects and processes personal data. It covers all personal data collected by the company whether obtained online, at medical facilities, through patient services or through other interactions. It applies to personal data related to patients, visitors, suppliers, third-party vendors, contractors, job applicants and employees.

National Medical Care Company, its branches, and its subsidiaries comply with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), enacted by Royal Decree No. (M/19) dated 16/09/2021 and amended by Royal Decree No. (M/148) dated 27/03/2023 as well as other applicable healthcare and regulatory requirements in the Kingdom of Saudi Arabia.

By receiving healthcare services from National Medical Care Company, its branches, and its subsidiaries, visiting facilities, interacting with care website or engaging through other communication channels, you acknowledge that your personal data will be processed in accordance with this Privacy Notice.

2- Controller

National Medical Care Company, its branches, and its subsidiaries is the controller of user data who is responsible for the collection, use and protection of user personal data. As the data controller, we determine the purposes and means of processing personal data in accordance with the Personal Data Protection Law (PDPL) and applicable healthcare regulations in the Kingdom of Saudi Arabia.

Contact Details:

Involved Department/Team: Data Governance Committee
Address: RHTA2409
E-mail: [email protected]

3- Personal Data Collection

At National Medical Care Company, its branches, and its subsidiaries, specific personal data is collected from patients and other stakeholders to provide healthcare services, comply with healthcare regulations and manage operational, administrative, and employment functions.

From Patients or Customers

Personal Information: Names, National ID / Iqama / Passport number, Medical Record Number (MRN), date of birth, gender, nationality, contact details (mobile number, email address, physical address) and emergency contact information.
Medical and Health Information: Medical history, diagnosis details, treatment records, laboratory results, radiology reports, prescriptions, clinical notes, medical coding data, physician assessments and healthcare professional registration information relevant to patient care. This information is necessary for diagnosis, treatment, medical documentation, quality monitoring and regulatory reporting.
Insurance Information: Insurance policy details, eligibility verification records, claim submissions, approvals and coverage information required to process medical claims.
Financial and Billing Information: Billing records, invoice data, transaction details and payment records related to healthcare services provided.
Quality and Incident Reporting Data: Information recorded in clinical audits, patient safety reports, quality assurance reviews and incident management documentation.
Customer Service Interaction Records: Records of communications with patient services, including call logs, emails, feedback submissions and complaint records.
Security Information: CCTV footage and facility access records captured on Hospital premises to ensure the safety of patients, visitors and staff.
System and Audit Logs: System access records, electronic medical record (HIS/ERP) audit trails, user activity logs and backup archives maintained to ensure system integrity, accountability and regulatory compliance.

From Business Partners (Suppliers, Contractors, Business Representatives and Third-Party Vendors)

Personal Information: Names, email addresses and phone numbers of authorized representatives.
Professional Information: Job titles, professional licenses, qualifications and roles within their organization.
Financial Information: Bank account details, transaction data and payment records related to contractual services.
Engagement and Legal Records: Contract documentation, compliance records, due diligence documentation and legal correspondence related to the provision of services to the Hospital.

From Visitors

Personal Information: Names and identification details (National ID / Iqama / Passport where applicable).
Security Information: CCTV footage and access control records used to monitor and regulate entry into Hospital premises.

From Employees and Job Applicants

Personal Information: Full name, National ID / Iqama details, contact information, identification data provided in employment applications and CVs.
Employment Information: Work history, qualifications, professional licenses, references, interview records, employment contracts, role assignments, attendance records, leave records, payroll information and performance evaluations.
Training and Compliance Records: Records of participation in mandatory healthcare training, professional development programs and compliance-related sessions.
Background Verification Data: Education verification, employment verification and other screening information collected where legally permitted.
Investigation and Disciplinary Records: Information processed in connection with internal investigations, complaints or disciplinary actions.
System Access Logs: User access records and audit logs relating to internal Hospital systems.

Note on Mandatory vs. Optional Data

Mandatory Data: Includes personal data necessary to provide healthcare services, create and maintain medical records, process insurance claims, comply with Ministry of Health and other regulatory requirements, manage employment and contractual relationships, maintain financial records and ensure physical and information security within Hospital premises.
Optional Data: Includes personal data collected with consent for voluntary initiatives such as surveys, feedback programs or non-essential digital services. Choosing not to provide optional data will not affect access to essential healthcare services, except where such data is required for medical, legal or regulatory purposes.

4- Methods of Personal Data Collection

National Medical Care Company, its branches, and its subsidiaries employs various lawful methods to collect personal data, ensuring accuracy, transparency and compliance with the Personal Data Protection Law (PDPL) and applicable healthcare regulations in the Kingdom of Saudi Arabia.

Personal data is collected through the following methods:

Direct Collection: Personal data directly collected from users when they engage, such as:

Registering as a patient at facilities.
Requesting medical services at Hospital facilities or home-based medical services through our call center or appointment scheduling channels.
Providing residential address details and access instructions for home-based services.
Submitting medical history or insurance information.
Communicating with patient services or submitting complaints or feedback.
Applying for employment opportunities or submitting a CV.
Entering into contracts as a supplier, contractor or business partner.
Visiting our premises and providing identification details for access control purposes.

Collection during Medical Service Delivery

Personal data is collected during consultations, examinations, laboratory testing, radiology services, medical procedures and follow-up appointments, whether conducted at Hospital facilities or at a patient's residence through approved home service arrangements.

Call Centre and Communication Channels

Personal data may be collected when communicate through telephone calls, emails, online forms or other official communication channels. Call logs and service request records may be maintained for operational and quality purposes.

Automated System Collection

Certain technical and system-related information is automatically recorded when using our company Information Systems, internal platforms or website. This may include system access logs, audit trails, IP address, device information and other security-related monitoring data.

Essential cookies and similar tracking technologies on our website to support essential functionality, improve user experience, and maintain security.

Third-Party Sources

Personal data may receive from third parties where permitted by law and necessary for service delivery or regulatory compliance, including:

Insurance providers for eligibility verification and claims processing.
Healthcare professionals or laboratories involved in your treatment.
Regulatory or governmental authorities where required.
Recruitment platforms or reference providers in relation to employment applications.

Security and Surveillance Systems

CCTV systems and access control mechanisms installed at Hospital facilities collect security-related data to ensure the safety of patients, visitors and staff.

5- Use of Personal Data

National Medical Care Company, its branches, and its subsidiaries utilizes the collected personal data for the following purposes, aligned with our healthcare, operational and regulatory responsibilities:

Provision of Healthcare Services: personal data may be used to assess, diagnose, treat and monitor medical conditions and to deliver healthcare services requested by you. This includes maintaining medical records, issuing prescriptions, conducting laboratory and radiology services, documenting clinical care, and ensuring continuity of treatment, whether provided at our facilities or through approved home-based services.
Patient Support and Administration: personal data may be used to register patients, schedule appointments, coordinate services, manage admissions and discharges and maintain accurate patient records. This also includes managing communications through our call centre and official communication channels.
Insurance and Billing Processing: We use personal data to verify insurance eligibility, submit and manage claims, issue invoices, process payments and maintain financial records related to healthcare services provided.
Quality and Patient Safety Management: personal data may be used to conduct clinical audits, manage incident reporting, support accreditation processes and continuously improve healthcare quality and patient safety standards.
Compliance with Legal and Regulatory Obligations: personal data may be used to comply with applicable healthcare regulations, reporting obligations and lawful requests from competent authorities in the Kingdom of Saudi Arabia.
Security and Protection Measures: personal data may be used to safeguard our facilities and systems, including monitoring CCTV systems, managing access controls, reviewing audit logs and protecting our information systems from unauthorized access.
Business and Financial Operations: personal data may be used to support accounting processes, procurement activities, vendor management, payroll administration, internal audits and operational management.
Recruitment and Employment Management: personal data may be used to evaluate job applications, conduct interviews, verify qualifications, administer employment contracts, manage payroll and attendance and deliver mandatory training programs.
Complaint Handling and Investigations: personal data may be used to process complaints, manage whistleblowing reports, conduct internal investigations and ensure compliance with applicable laws and internal policies.
Marketing and Promotional Communications: With user consent, contact details may be used to send health awareness campaigns, service updates, screening programs or promotional communications related to our services. User may withdraw your consent to receive marketing communications at any time.
Responding to Data Subject Rights Requests: personal data may be used to process and respond to requests submitted under the Personal Data Protection Law (PDPL) including requests for access, correction or deletion.

6- Legal Basis for Processing

National Medical Care Company, its branches, and its subsidiaries processes personal data in accordance with the Personal Data Protection Law (PDPL) and applicable healthcare regulations in the Kingdom of Saudi Arabia. The legal bases for processing include the following:

Legal Obligation: personal data may be processed where required to comply with applicable healthcare laws, Ministry of Health regulations, medical record retention requirements, financial and tax regulations, labour laws and lawful requests from competent authorities in the Kingdom of Saudi Arabia.
Contractual Necessity: Personal data is processed where necessary to provide healthcare services requested by you, administer insurance claims and billing, manage appointments and fulfil employment or contractual obligations with staff and suppliers.
Vital Interests: In medical emergencies or situations requiring urgent care, we may process personal data where necessary to protect the life or physical safety of a patient.
Actual Interest: personal data may be processed where necessary to achieve a real and direct interest that benefits the patient, particularly in situations where obtaining consent in advance is not practical and processing is required to facilitate healthcare service delivery.
Legitimate Interests: personal data may be processed where necessary for legitimate operational purposes that do not override your fundamental rights and freedoms, including system security, fraud prevention, quality assurance, internal audits, access control, CCTV monitoring and service improvement.
Consent: We obtain explicit consent for processing activities that are not based on legal obligation, contractual necessity, legitimate interest, actual interest or vital interest. This includes marketing communications, promotional campaigns and other optional services. You may withdraw your consent at any time and this will not affect the lawfulness of processing carried out prior to withdrawal.

7- Protection of Personal Data

At National Medical Care Company, its branches, and its subsidiaries, safeguarding personal data is a priority that we take very seriously. We are committed to implementing appropriate technical and organizational security measures to protect personal data from unauthorized access, disclosure, alteration, loss or misuse. These measures are aligned with industry best practices, healthcare regulatory requirements and the Personal Data Protection Law (PDPL).

Technical Security Measures

Data Encryption: Personal data stored within our systems, including medical records and financial information, is protected through encryption mechanisms both at rest and in transit where applicable.
Access Control and Role Based Permissions: Access to personal data is restricted to authorized personnel only, based on their job responsibilities and need to know basis.
System Monitoring and Audit Logs: We maintain system access logs and audit trails to monitor system usage, detect unauthorized access and ensure accountability.
Network Security Controls: Systems are protected using firewalls, intrusion detection mechanisms and regular vulnerability assessments to maintain system integrity.
Secure Backup and Archiving: Personal data is securely backed up and archived in accordance with retention requirements to ensure availability and resilience.

Organizational Security Measures

Data Protection Policies and Training: We implement internal policies and procedures governing the processing of personal data and provide regular training to employees on data protection and confidentiality obligations.
Confidentiality Obligations: All employees, healthcare professionals, contractors and third party service providers are bound by confidentiality obligations to protect personal data.
Physical Security Measures: Our facilities are protected through controlled access mechanisms, ID-based entry systems and CCTV monitoring to safeguard both physical and digital records.
Vendor and Third Party Management: Third party service providers are subject to contractual safeguards, including confidentiality clauses and data protection obligations, to ensure that personal data is handled securely.

8- Personal Data Recipients

National Medical Care Company, its branches, and its subsidiaries may disclose personal data or specific categories of personal data to third parties within the Kingdom of Saudi Arabia where such disclosure is necessary for healthcare delivery, operational purposes, contractual obligations or regulatory compliance and in accordance with the Personal Data Protection Law (PDPL).

Depending on the nature of the service provided and applicable regulatory requirements, we may disclose either all personal data or specific categories of personal data on a one-time or recurring basis. Such disclosure is limited to what is necessary to achieve the intended purpose.

Personal data may be shared with the following categories of recipients:

Healthcare Professionals and Medical Service Providers: Including physicians, specialists, laboratories, radiology providers and other healthcare professionals involved in diagnosis, treatment and continuity of care, including home based service delivery where applicable.
Insurance Companies and Corporate Clients: For eligibility verification, claims processing, approvals, billing administration and reimbursement purposes.
Government and Regulatory Authorities: Including the Ministry of Health and other competent authorities where reporting, regulatory disclosure or legal compliance is required.
Accreditation and Quality Assessment Bodies: Where required for accreditation reviews, healthcare compliance audits or quality assurance assessments.
Training and Professional Development Providers: For the administration of healthcare training programs, professional certifications, compliance training and workforce development initiatives where employee data is required.
Recruitment and Background Verification Providers: Where engaged to support employment screening, qualification verification and recruitment processes.
Professional Advisors: Including external auditors, legal advisors, financial consultants and compliance consultants engaged to support our healthcare, financial and regulatory functions.
Cloud Hosting and Infrastructure Providers: Where applicable, third party infrastructure providers supporting the hosting and secure operation of authorized systems within the Kingdom of Saudi Arabia.
Suppliers and Business Partners: Where necessary for procurement activities, service coordination, equipment supply or contractual management.

Domestic Processing

National Medical Care Company, its branches, and its subsidiaries processes and stores personal data within the Kingdom of Saudi Arabia. We do not transfer personal data outside the Kingdom unless required by law and in compliance with applicable PDPL requirements.

9- Retention Period of Personal Data

National Medical Care Company, its branches, and its subsidiaries retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, medical, accounting or reporting requirements.

We determine retention periods based on the following principles:

Operational Necessity: We retain personal data for as long as required to provide healthcare services, manage our operations, and maintain necessary records.
Legal and Regulatory Compliance: Certain categories of personal data are retained for specific periods as required by applicable healthcare laws and regulatory requirements in the Kingdom of Saudi Arabia. For example, medical records may be retained for a defined period (such as ten years from the date of last treatment), where required by applicable healthcare regulations.
Contractual and Administrative Requirements: Personal data relating to employment, financial transactions or contractual relationships is retained in accordance with applicable contractual and administrative requirements.

Upon expiry of the applicable retention period, personal data is securely deleted, destroyed or anonymized in accordance with our internal policies and applicable legal requirements.

10- Use of Cookies

At National Medical Care Company, its branches, and its subsidiaries website, we use cookies and similar technologies to enhance your browsing experience, maintain website functionality and support the security of our digital platforms.

Cookies are small text files that are placed on your device when you visit our website. They help us recognize your device and improve how our website operates.

We use the following types of cookies:

Essential Cookies: These cookies are necessary for the basic functionality of our website, including enabling secure access to certain areas, supporting appointment requests and maintaining system security.

User may manage or disable cookies through browser settings. However, disabling certain cookies may affect the functionality of our website.

11- Data Subject Rights

At National Medical Care Company, its branches, and its subsidiaries, we respect users' privacy and provide user with the ability to exercise their rights in accordance with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL). The following rights are available to you:

Right to be Informed: User have the right to be informed about how we collect personal data, the legal basis for its processing, how it is used, stored, retained and with whom it may be shared. This information is provided through this Privacy Notice.
Right to Access Your Personal Data: User have the right to access the personal data that we hold about them through the available means provided by the Hospital such as, application or other means.
Right to Request a Copy of Your Personal Data: User may request to obtain a copy of your personal data in a clear and readable format, subject to applicable legal and regulatory requirements.
Right to Request Correction of Personal Data: If user believe that the personal data we hold about them is inaccurate, incomplete or outdated, they have the right to request its correction or update.
Right to Request Destruction of Personal Data: User may request the destruction of personal data when it is no longer necessary for the purposes for which it was collected, subject to applicable legal, medical and regulatory retention requirements.
Right to Withdraw Consent: Where processing is based on user consent, they may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out prior to the withdrawal.
Right to File a Complaint: If user believe that National Medical Care Company, its branches, and its subsidiaries has not complied with the Personal Data Protection Law, they have the right to submit a complaint to us. If they are not satisfied with the outcome, they may escalate the complaint to the competent authority.
Right to Claim Compensation: User are entitled to claim compensation for any material or moral damage resulting from a violation of the Personal Data Protection Law and its implementing regulations.

12- How to Exercise Your Rights

To exercise any of the rights described above, contact National Medical Care Company, its branches, and its subsidiaries using the designated privacy contact details provided below. User may also submit a formal Data Subject Request (DSR) through:

Email: [email protected]

Specific information may be requested from you to verify your identity before processing your request. This is to ensure that personal data is not disclosed to unauthorized individuals.

User will not be required to pay any fees for exercising their rights, unless otherwise permitted under applicable laws. National Medical Care Company, its branches, and its subsidiaries will respond to requests within the timeframe prescribed under the Personal Data Protection Law (PDPL).

If a request cannot be fulfilled due to legal, regulatory or medical record retention requirements, we will inform you of the reason in accordance with applicable laws.

13- Complaints and Escalation

For further details regarding the processing of personal data or how to exercise rights, you may contact the Data Protection Officer at National Medical Care Company, its branches, and its subsidiaries using the contact details below:

Data Governance Committee
Email: [email protected]

Complaint or Objection Filing Method

If there is any concern or you believe that National Medical Care Company, its branches, and its subsidiaries has not complied with the Personal Data Protection Law (PDPL), submit a complaint using the contact details provided above.

If not satisfied with how the complaint is handled, or if we fail to respond within the prescribed timeframe, you may escalate the complaint to the competent authority in the Kingdom of Saudi Arabia.

Primary Authority:
Saudi Data & Artificial Intelligence Authority (SDAIA)
Website: https://sdaia.gov.sa

Where applicable, healthcare related regulatory matters may also be raised with the Ministry of Health or other competent authorities in accordance with applicable laws.

14- Changes to this Privacy Notice

National Medical Care Company, its branches, and its subsidiaries reserves the right to update or modify this Privacy Notice at any time to reflect changes in our data processing practices, updates in applicable laws or regulations or adjustments in our operational activities.

Any updated version of this Privacy Notice will be published on our official website and will indicate the date of the latest revision. Where required by law, we will notify individuals of material changes through appropriate communication channels.