This English translation is provided for convenience; the Arabic version prevails.
Lolya Medical Clinics (the “Center”, “we”) is committed to protecting your privacy and your personal and health data in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) and its Implementing Regulations, as well as the applicable health regulations in the Kingdom of Saudi Arabia.
1. Who We Are
Data controller: Lolya Medical Clinics, Ministry of Health license No. , Commercial Registration , address: شارع الملك فيصل (متفرع من شارع الملك عبدالعزيز)، أعلى سوق الذهب، مبنى 3788، حي الفيصلية، نجران. For inquiries about your data: privacy@lolya.sa.
2. Data We Collect
| Type | Examples | Source |
|---|---|---|
| Identity and contact data | Name, mobile number, email, date of birth, national ID number (optional) | From you when booking or registering |
| Health data (sensitive data) | Reason for visit, diagnosis, treatment plan, clinical photos | From you and your treating physician |
| Payment data | Last 4 digits of the card, transaction status | The payment gateway (we do not store the full card number) |
| Technical data | Device type, pages visited, cookies | Automatically when you use the website |
3. Purposes and Legal Basis of Processing
- Providing medical care and managing appointments: based on your explicit consent to the processing of your health data, and to deliver the requested service.
- Billing and regulatory obligations: issuing tax invoices and retaining medical records as required by law.
- Service communications: confirmations, reminders and cancellations via WhatsApp, SMS and email.
- Marketing: only with your separate consent, which you may withdraw at any time.
- Improving the website: using aggregated statistical data.
4. Data Sharing
We do not sell your data. We share it only when necessary with: the licensed payment gateway, messaging service providers, insurance companies (at your request and with your consent), and government authorities where there is a legal obligation. All service providers are bound by data protection agreements.
5. Transfers Outside the Kingdom
We store your health data on servers located within the Kingdom of Saudi Arabia. If a service requires transferring non-health data outside the Kingdom, this is done in accordance with the controls set out in the regulations.
6. Retention Period
We retain medical records for the period required by Ministry of Health regulations, and financial records for the period required by zakat and tax regulations. Marketing contact data is deleted when you withdraw your consent.
7. Your Rights
- To be informed of how your data is processed.
- To access your data and obtain a copy of it.
- To request correction or updating of your data.
- To request destruction of your data once it is no longer needed, subject to statutory retention periods.
- To withdraw your consent at any time.
You can exercise your rights from the Privacy & My Data page in your account, or by contacting us. We respond within the statutory period. You also have the right to file a complaint with the Saudi Data & AI Authority (SDAIA).
8. Data Security
We use encryption in transit (SSL/TLS) and at rest, role-based access restrictions, audit logs, and regular backups.
9. Children’s Data
Data of persons under 18 is processed with the consent of their guardian, and the guardian books appointments from their own account.
10. Cookies
We use cookies that are necessary for the website to function, as well as analytics and marketing cookies that are only enabled with your consent through the cookie settings panel.
11. Policy Updates
We may update this policy, and we will notify you of any material change via the website or by message.