Privacy Notice

Who we are

Clinic Hub is an online marketplace that connects patients with clinics and doctors, and clinics with medical suppliers. Clinic Hub is not a healthcare provider: the care itself is provided by the clinics and doctors you choose.

The platform is operated by:

[Operator legal name, commercial registration number and address — to be confirmed by the business]

For counsel: Counsel to confirm the controller(s): Clinic Hub's operator, and the role of each clinic for the clinical records it creates.

What we collect

Depending on how you use Clinic Hub, we collect:

• Everyone: your name, email address and phone number.
• Patients: your National ID or Iqama number, date of birth and gender; your appointments, invoices, consultation and treatment records; and health information you or your clinic add, such as allergies, conditions, blood type, medical notes and an emergency contact.
• Doctors: your SCFHS licence number and expiry, your National ID, and the credential documents you upload.
• Clinics and suppliers: company identity, commercial registration, MOH, municipality and SFDA licences, VAT number, bank name, account holder and IBAN, and the licence documents you upload.
• Anyone who uses our contact form: your name, organisation, role, phone, email, city and message.

For counsel: Health data, face images and national identifiers are sensitive data. Counsel to state the lawful basis for each category and the explicit-consent wording where it is required.

Your National ID or Iqama number

Patients give their National ID or Iqama number when they sign up. We use it to identify you as a patient and to prevent two patient records for the same person. In the product it is shown only to you, on your own profile: clinics and doctors do not see it, and it is never shown publicly.

A doctor's National ID is part of their credentials, and is seen by the platform administrators who verify them.

For counsel: Counsel to confirm the lawful basis for collecting the National ID/Iqama, and whether it may be required at sign-up.

Health and medical information

Clinical records (consultations, treatment plans, procedures and the materials used) are created by the clinics and doctors who treat you. A doctor sees your records only while they have an appointment or treatment with you.

Sharing your past treatments with the doctor treating you is on by default, so a doctor does not repeat a procedure or use a product that interacts with an earlier one. You can turn it off in your profile. Your allergy list is a safety control and is shown to a treating doctor either way.

For counsel: Counsel to confirm whether sharing treatment history across clinics may be on by default, and the MOH requirements for medical records.

Images and uploaded files

Licence and credential documents are kept in private storage. Administrators reviewing an application open them through short-lived links.

Face photos are collected only by Skin Analysis, which is currently not available. If it is offered, you will be asked for your consent before any photo is taken.

For counsel: Counsel to set retention periods for photos and documents. Today nothing is deleted automatically.

Artificial intelligence

When a doctor asks the protocol assistant for suggestions, the consultation notes the doctor typed are sent to our AI provider (Anthropic, in the United States) to rank the clinic's published protocols. A suggestion is not medical advice: the doctor decides.

Skin Analysis, which would send a face photo to the same provider for analysis, is currently not available.

For counsel: Counsel to confirm the AI disclosure wording, and whether sending clinical notes or photos to a provider outside the Kingdom is permitted.

Who processes your data, and where

We use these service providers. Your data is currently stored and processed outside the Kingdom of Saudi Arabia.

• Supabase — database, sign-in and file storage (Tokyo, Japan).
• Vercel — hosts the application (Tokyo, Japan).
• Anthropic — the AI described above (United States).
• Resend — sends our emails, once email delivery is enabled.
• Jitsi / 8x8 — video consultations, where they are used.
• Network International — card payments, once online payment is enabled (Saudi Arabia).
• Harmony ERP, HBMC's financial system — once this connection is switched on, it receives the platform's own revenue per transaction and the clinic it relates to, each clinic's onboarding steps, and the name, email, phone number, role and city given in business enquiries from clinics, suppliers and doctors. Harmony passes the onboarding steps and those enquiries on to Oryven's customer-relationship system (Oryven CRM). No patient data and no patient enquiry is sent.

For counsel: Flag: health data and national identifiers are stored outside the Kingdom. Counsel to confirm this is permitted under the PDPL transfer rules and MOH/NCA requirements, or whether data must be hosted in the Kingdom before real patients are onboarded. Also: the role of HBMC (Harmony ERP) and of Oryven (Oryven CRM) — processor, joint controller or separate controller — and where each hosts this data, which the business must supply.

How long we keep it

Financial records (invoices, payments and the accounting ledger) are kept and never edited: a correction is recorded as a new entry. Other data is kept for as long as your account exists.

For counsel: Counsel to set retention periods, and how a deletion request is honoured alongside invoice-retention obligations.

Your requests

To ask what data we hold about you, to correct it, or to ask about deleting it, use the contact form and choose “Privacy request”, or email:

[Privacy contact email — to be confirmed by the business]

You can correct most of your profile yourself, and turn treatment-history sharing off, from your profile page.

For counsel: Counsel to list the rights that apply and the response time.

Changes to this notice

Each version of this notice has a version number, shown at the top. When the notice changes, we ask you to read and accept the new version.