Privacy Policy for Electronic Services of AL Yousif Hospital

1. Introduction

At AL Yousif Hospital, we are committed to protecting your privacy and ensuring that your personal and health information is handled with the highest standards of confidentiality and security. This Privacy Policy explains how we collect, use, disclose, and protect your personal and health information when you use our website, mobile applications, and other electronic services and platforms provided by the hospital.

This policy applies to all electronic services provided by AL Yousif Hospital, including the website, smart device applications, and any other electronic platforms affiliated with the hospital, unless otherwise stated.

By using any of our electronic services, you acknowledge that you have reviewed this policy and agree to the collection, use, and processing of your personal information as described herein.

2. Data We Collect

We may collect or process the necessary personal and health data to provide our electronic services, including:

First: Primary User Data (Account Holder):

  • Full name.
  • National ID number, Border Number, or Medical Record Number.
  • Mobile number.
  • Email address (if available).
  • Medical appointment data.
  • Medical file records.
  • Laboratory test results.
  • Radiology reports.
  • Prescriptions and dispensed medications.
  • Health insurance data when needed.
  • Billing and medical services data.

Second: Data of Added Family Members (Dependents):

When you (as a guardian or authorized person) add your family members to the application, we may collect and process the following data specific to them to provide health follow-up features:

  • Full name of the added individual.
  • National ID number, Iqama number, or their Medical Record Number.
  • Date of birth and relationship to you.
  • Sick leave records issued for them.
  • Laboratory test results specific to them.
  • Radiology reports specific to them.
  • Medical appointment data related to them.
  • Their medical file records (with the understanding that we do not collect or process the list of dispensed medications for family members through this feature; data collection is limited to the information contained in their medical records related to tests, radiology, and sick leave).

Third: Technical Information:

Such as device type, operating system version, IP address, and crash logs, to improve the quality and performance of electronic services.

3. Identity Verification

Some of our electronic services may require user identity verification before granting access to their personal or health data, using appropriate verification methods depending on the service type, which may include the National ID number, Border Number, or Medical Record Number, in addition to other verification means such as a One-Time Password (OTP) when necessary.

Special Note Regarding Family Data: When attempting to access family members’ data (such as sick leave or test results), the user’s (guardian’s) authorization will be verified to ensure their right to view that data before it is displayed.

4. Use of Information

The information collected is used for the following purposes:

  • User identity verification.
  • Providing electronic health services.
  • Managing appointments and medical services for the user and their family members.
  • Displaying the user’s medical information (such as medical records, tests, and radiology).
  • Displaying and managing sick leave records (for the user and added family members).
  • Displaying laboratory test results and radiology reports (for the user and added family members).
  • Following up on health insurance requests.
  • Displaying bills and related services.
  • Sending notifications and reminders related to health services (for the user and family members when applicable).
  • Improving and developing the quality of electronic services.
  • Complying with regulations, instructions, and legal obligations in the Kingdom of Saudi Arabia.

5. Data Sharing

AL Yousif Hospital does not sell or rent personal or health data to any party for commercial purposes.

Data may be shared in the following cases:

  • With healthcare providers involved in delivering the service to the user or their family members.
  • With insurance companies or relevant parties when necessary to provide the service.
  • When required by legal obligation or an order from a competent authority.
  • With technical service providers who offer operational or hosting services for the systems, provided they commit to maintaining the confidentiality of the information.
  • Note: When a guardian accesses their family members’ data, this data is shared and displayed only to the guardian who added them and is not shared with other parties except as outlined above.

6. Data Protection

The hospital is committed to applying appropriate security, administrative, and technical measures to protect personal and health data, including:

  • Encrypting data during transmission.
  • Protecting data during storage.
  • Applying access permissions based on job functions.
  • Monitoring systems and detecting unauthorized access attempts.
  • Periodically updating security systems.
  • Training employees on information confidentiality and data security.

7. Data Retention

Personal and health data are retained according to the periods specified by applicable laws and regulations in the Kingdom of Saudi Arabia, or as long as necessary to provide health services and fulfill legal obligations. This policy applies to the primary user’s data and the data of added family members.

8. Application Permissions

The hospital’s smart device applications may require certain device permissions necessary to provide services, such as:

  • Internet connectivity.
  • Sending notifications.
  • File storage (saving or uploading) when this feature is available (e.g., uploading a sick leave image or downloading reports).

None of these permissions are used except for the specific purpose for which they were granted, and the user can control them through their device settings.

9. Technical Information

We may automatically collect certain technical information when using our electronic services, such as:

  • Device type.
  • Operating system version.
  • IP address.
  • Time of service use.
  • Crash and error logs.

This information is used to improve performance, service quality, and address technical issues.

10. User Responsibility Regarding Family Data

By adding any family member (dependent) to your account in the application, you acknowledge and undertake the following:

  • You have obtained explicit consent from that individual (or you are their legal guardian according to applicable regulations) to view and process their health data (sick leave, tests, radiology) through the application.
  • You bear full responsibility for maintaining the confidentiality of your account login credentials, and any access made through your account to your family members’ data is considered authorized by you.
  • If the guardianship or authorization relationship ends, you must remove the added individual from the application, and the hospital shall be responsible for deleting the data in accordance with applicable regulations.

11. Children’s Privacy

Some of our electronic services may be used by parents or legal guardians of patients to manage accounts for their children or dependents, in accordance with applicable regulations and procedures and after identity verification.

We do not directly collect children’s data without the guardian’s consent, and the guardian remains responsible for managing this data and authorizing access through their account.

12. Data Transfer

Data is processed within the hospital’s approved systems. Personal data is not transferred outside the Kingdom of Saudi Arabia unless legally permitted or if it is necessary to provide the service or fulfill a legal obligation.

13. User Rights

The user has the right, in accordance with applicable laws and regulations (including the Saudi Personal Data Protection Law), to:

  • Access their personal data.
  • Request correction or update of inaccurate data.
  • Request deletion of their account or personal data by contacting the hospital via email at info@ayh.com.sa, while noting that data or medical records required to be retained by health regulations or laws will be maintained.
  • Object to certain data processing operations according to the regulations.
  • Withdraw consent in cases where processing is based on the user’s consent.

Note: These rights include the primary user’s data. Additionally, the user (guardian) has the right to request correction or update of the data of their added family members.

14. Amendments to the Privacy Policy

AL Yousif Hospital reserves the right to amend or update this Privacy Policy at any time. The updated version will be posted on this page with the date of the latest revision. We recommend you review this page periodically for any changes.

15. Contact Us

For any inquiries regarding the Privacy Policy or personal data protection, please contact us at:

AL Yousif Hospital
Phone: +966 138011950
Email: info@ayh.com.sa
Website: https://ayh.com.sa

Consent

By using AL Yousif Hospital’s website, mobile applications, or any of its electronic services or platforms, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and processing of your personal information, as well as the information of your added family members (when you add them), as described above.