Privacy Policy

Last updated: Oct 29, 2026

1Who we are

This Privacy Policy explains how Zaheen Tech (زاين تيك) collects, uses, shares, stores and protects personal data, in accordance with the Saudi Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H (as amended), its Implementing Regulations, the Regulation on Personal Data Transfer Outside the Kingdom, and the rules and guidance issued by the Saudi Data and Artificial Intelligence Authority (SDAIA) (together, the PDPL).

In this Policy, "Zaheen", "we", "us" and "our" mean the entity above. "You" means any person whose personal data we process. Terms such as personal data, sensitive data, health data, controller, processor and processing have the meanings given in the PDPL.

We make this Policy available before or at the time we collect your personal data. Until we publish the Arabic version of this Policy, the English version governs. Once the Arabic version is published, it prevails if the two differ.

2Scope and our role

This Policy applies to all of our Services: the zaheentech.com website, our mobile and web applications (including Doori), our software-as-a-service platforms (including our healthcare claims management platform), our consulting and software development services, and any communication with us by email, phone, WhatsApp or social media.

We act in two different capacities under the PDPL:

Where we act as a processor, we process data only on the Customer's documented instructions and under a Data Processing Agreement. If you are a patient of one of our Customers, please direct requests about your data to that Customer first; we will support them in answering you (see section 5).

This Policy does not cover third-party websites, apps or services that our Services link to, such as payment pages, app stores, insurers or government portals. Their own policies apply.

3Personal data we collect

We collect only the personal data that is necessary for the purposes in section 4. The main categories are listed below. If a specific product (for example Doori) collects other data, we will describe it in that product's privacy notice before collecting it and, where required, ask for your consent first.

What we do not collect as controller. We do not collect national ID or Iqama numbers, dates of birth, precise location, biometric data, or health data for our own purposes, unless a specific Service requires it and we tell you first. We never store full card numbers or card security codes; these are handled directly by licensed payment providers.

Data you give us about others. If you give us another person's data (for example a colleague's contact details), you confirm you are permitted to do so and that you have told them about this Policy.

4Why we use your data and our legal basis

Each purpose below has its own legal basis under the PDPL. Where we rely on consent, we ask for it separately for each purpose, and using our core Services never depends on agreeing to optional processing such as marketing or analytics cookies.

Legitimate interest. Where we rely on legitimate interest, we have assessed that the purpose is lawful in the Kingdom, that the processing is necessary, and that it does not override your rights. We never rely on legitimate interest to process sensitive data. You can ask us for a summary of the assessment.

New purposes. We will not use your data for a purpose that is incompatible with the one it was collected for. If we need to, we will tell you first and obtain your consent where the PDPL requires it.

Withdrawing consent. You can withdraw any consent at any time, as easily as you gave it, through your account settings, the unsubscribe link, or by emailing info@zaheentech.com. Withdrawal does not affect processing carried out before it.

5Health data and Customer data on our platforms

Our healthcare platform processes health data, which the PDPL classes as sensitive data. We process it only as a processor for our Customers, who are the controllers and are responsible for having a lawful basis, including any patient consent or notice that the PDPL and health-sector rules require.

For data that Customers upload to or connect to our platforms (Customer Data), we commit to the following:

1. Instructions only. We process it only to deliver the contracted Services (for example preparing, validating and tracking NPHIES claims and eligibility checks) and never for our own marketing, profiling or sale.
2. In-Kingdom hosting. Customer health data is hosted on servers located in the Kingdom of Saudi Arabia. We do not transfer it, or allow access to it from outside the Kingdom, except on the Customer's documented instruction and in compliance with the PDPL. We never send Customer Data to AI or large language model services hosted outside the Kingdom.
3. Restricted access. Only authorised Zaheen personnel who need access to provide support, under confidentiality obligations, can access it, and access to production systems is logged.
4. Encryption. It is encrypted in transit and at rest.
5. Sub-processors. We use sub-processors only under written terms at least as protective as ours, and we give Customers a list and prior notice of changes.
6. Assistance. We help Customers answer data subject requests, carry out impact assessments, and meet breach notification duties.
7. Return and destruction. When the agreement ends, we return or destroy Customer data as the Customer instructs, unless the law requires us to keep it.
8. Health-sector rules. We design the platform to support Customers' compliance with the requirements of the Council of Health Insurance (CHI), the Insurance Authority, NPHIES and the Ministry of Health, and we apply security measures with reference to National Cybersecurity Authority (NCA) guidance.

Machine learning. Where a Service uses models (for example to predict the risk of a claim being rejected), outputs are decision-support only, and a qualified person at the Customer makes the final decision. We do not use Customer Data to train models or to create statistics for our own purposes. We do so only where the Customer instructs it in an Order Form under the Data Processing Agreement, for the Customer's own benefit, and only after de-identification that meets PDPL standards.

Patients. If you are a patient and want to access, correct or delete your data, contact your clinic or provider. If you contact us directly, we will forward your request to the relevant Customer without undue delay.

Secure channels only. Customers must not send patient data to us by email, WhatsApp or support tickets. Please use the platform's secure upload and in-platform support channel.

Managed services. Where we provide services beyond the software, such as claims follow-up or denial recovery, the Order Form and the Data Processing Agreement define our role and responsibilities for that data.

6Cookies and similar technologies

We use strictly necessary cookies by default and set all other cookies only after you accept them in our cookie banner. You can change your choice at any time from the "Cookie settings" link in the website footer or in the app settings.

The current list of cookies, their providers and lifetimes is shown in the cookie settings panel. Blocking strictly necessary cookies in your browser may stop parts of the Services from working. Our apps may use equivalent software development kits (SDKs), and the same choices apply. We do not use your data to build profiles that produce legal or similarly significant effects on you.

7Who we share data with

We do not sell or rent personal data. We share it only with the recipients below, only as much as each needs, and only under written confidentiality and data protection terms.

Requests from authorities. We disclose data to a public authority only when the law requires it, after checking that the request is valid and limited to what is necessary. We keep a record of each disclosure.

Aggregated data. We do not share statistics derived from Customer Data with third parties. We may publish statistics about our own website and app usage only in fully anonymised form, so that no individual can be identified, directly or indirectly.

8Where your data is stored

We store health data and patient data on our platforms only inside the Kingdom of Saudi Arabia. Only the names and email addresses of our Customers' Authorised Users may be processed outside the Kingdom, as set out in our Data Processing Agreement.

Some supporting tools we use may store limited account, contact and usage data outside the Kingdom:

These transfers rely on SDAIA's Standard Contractual Clauses or another lawful basis under the Regulation on Personal Data Transfer Outside the Kingdom, supported by a documented transfer risk assessment. We transfer only the minimum data needed. You can ask us for details of the safeguards that apply.

9How long we keep data

We keep personal data only as long as the purpose requires, then destroy it securely or anonymise it, unless a law requires us to keep it longer.

When we destroy data, we use methods that prevent it from being recovered, and we instruct our processors to do the same.

10Security and data breaches

We protect personal data with administrative, technical and organisational measures appropriate to the sensitivity of the data, as the PDPL requires and with reference to National Cybersecurity Authority (NCA) guidance, including:

• encryption in transit (TLS) and at rest;
• role-based access, least-privilege permissions and multi-factor authentication for staff;
• logging of access to production systems holding personal data;
• separation of each Customer's data;
• regular backups, vulnerability testing and security reviews;
• confidentiality undertakings and privacy training for everyone with access.

No system can be guaranteed to be completely secure. If a personal data breach occurs, we will:

1. contain it and investigate promptly;
2. notify SDAIA within 72 hours of becoming aware of it, where the PDPL requires;
3. inform affected individuals without undue delay where the breach may cause them harm, and tell them what steps to take;
4. where we are a processor, notify the affected Customer within 24 hours of becoming aware of the breach and give it the information it needs to meet its own duties.

Please report any suspected security issue to info@zaheentech.com.

11Your rights

Under the PDPL you have the following rights, free of charge:

How to make a request. Email info@zaheentech.com or write to our National Address. We may ask for reasonable information to verify your identity before acting. We will respond within 30 days. Where a request needs disproportionate effort, or you make repeated requests, we may extend this once by up to 30 days and will tell you the reasons in advance. If we refuse a request, in whole or in part, we will explain the reason.

Deleting your account. You can delete your account from inside our apps (Settings › Account › Delete account) or at zaheentech.com/delete-account. We delete the associated personal data within 30 days, except data we must keep by law, which we will tell you about.

Complaints. Please contact us first so we can try to resolve your concern. You also have the right to complain to SDAIA through its official channels, generally within 90 days of the incident or of becoming aware of it.

12Marketing, children, AI and changes

Marketing. We send marketing messages only with your prior consent. Every message identifies Zaheen and includes a simple way to unsubscribe. Service notices are not marketing and you will still receive them while you have an account. Promotional SMS and WhatsApp messages are sent only from registered sender IDs through licensed providers; reply STOP or use the link in the message to opt out.

Children. Our Services are intended for businesses and adults aged 18 or over. We do not knowingly collect personal data from anyone under 18 as controller. If you believe a minor has given us data, contact us and we will delete it. Where a Customer processes minors' data on our platform (for example a child patient's claim), the Customer is responsible for obtaining consent from the legal guardian.

Automated processing and AI. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Where an AI feature significantly affects you, we tell you, and a human can review the outcome on request.

Changes to this Policy. We will post any update on this page with a new "Last updated" date. For material changes, we will notify you by email or in-app at least 30 days before they take effect, unless a shorter period is required by law or for security reasons. Where a change requires new consent, we will ask for it rather than relying on continued use.

Contact us.

• Email: info@zaheentech.com
• Post: Zaheen Tech Company, Building 4450, Salim Ibn Abdullah Street, Al Muhammadiyah District, Additional No. 7084, Riyadh 12361, Kingdom of Saudi Arabia