1. Introduction

MetroMed Clinics is committed to respecting the privacy of patients, visitors, and other individuals, maintaining the confidentiality of their personal and health data, and implementing appropriate safeguards against unauthorized access, use, disclosure, alteration, or destruction.

This policy explains how MetroMed collects, processes, uses, shares, retains, and disposes of personal data, the rights available to data subjects, and the channels through which privacy inquiries may be submitted.

The policy shall be applied in accordance with applicable Saudi personal data protection legislation and implementing regulations, together with relevant healthcare, health insurance, and accreditation requirements applicable to the facility and its scope of operations.

2. Scope

This policy applies to personal data collected or processed through:

Clinic visits and direct interactions with staff.

The website and online forms.

Appointment booking, modification, and cancellation.

The call center, customer service, and communication channels.

Medical, diagnostic, and treatment services.

Medical records, laboratory results, radiology results, and clinical reports.

Health insurance eligibility checks, authorizations, claims, and billing.

Email, text messages, and digital communication channels.

Marketing and promotional communications, subject to applicable requirements.

IT systems and service providers processing data on behalf of MetroMed.

3. Categories of Data

Depending on the service, actual need, and applicable legal basis, MetroMed may process the following categories of data.

3.1 Personal and Identification Data

Name, date of birth, gender where relevant to the service, national identification or residency number or passport details where legally required, telephone number, email address, address, and necessary contact information.

3.2 Health Data

Medical history, symptoms, diagnoses, prescriptions, treatment plans, laboratory results, radiology results, medical reports, and other health information necessary for healthcare delivery.

3.3 Health Insurance Data

Insurer details, policy or membership number, eligibility and coverage status, medical authorizations, claims, invoices, and information necessary to process insurance transactions.

3.4 Appointment and Service Data

Requested specialty, appointment date and time, communication requests, complaints, feedback, and service history to the extent necessary for service administration.

3.5 Technical Data

Technical information necessary to operate and protect the website, including security and usage logs and cookie-related information, depending on the technologies used and the applicable privacy notice and consent settings.

MetroMed shall limit data collection to what is necessary for the specified purpose and shall not collect unnecessary information merely because it is available.

4. Purposes of Processing

Subject to the applicable legal basis, personal data may be processed for the following purposes:

Patient registration and identity verification where necessary.

Appointment booking, administration, and related communications.

Healthcare delivery, diagnosis, treatment, and follow-up.

Creation, maintenance, and authorized access to medical records.

Laboratory testing, diagnostic examinations, radiology, and reporting.

Insurance eligibility and coverage verification and authorization requests.

Insurance claims, invoicing, and payment administration.

Handling patient inquiries, complaints, and requests.

Service quality and patient safety activities, where applicable.

Compliance with applicable legal, healthcare, and insurance obligations.

Responding to lawful requests from competent authorities.

System security, prevention of unauthorized access, and investigation of security incidents.

Marketing communications where an appropriate legal basis and any required consent are in place.

5. Legal Basis and Consent

MetroMed shall determine the appropriate legal basis for each processing activity in accordance with applicable Saudi personal data protection legislation and implementing regulations.

Where consent is legally required, it shall be obtained in a clear and specific manner and appropriately documented.

Consent to receive healthcare does not automatically constitute consent to unrelated marketing communications or the promotional use of patient images, testimonials, or medical stories.

Consent shall not be treated as the sole legal basis for all processing activities. The appropriate legal basis must be determined according to the circumstances and applicable law.

6. Medical Confidentiality

Health data shall be treated as sensitive data requiring enhanced protection.

MetroMed shall:

Restrict access to medical records to authorized individuals with a legitimate need to perform their duties.

Prohibit access to or use of patient data for personal or unauthorized purposes.

Verify patient identity or the authority of a representative before disclosing information.

Use approved channels to transmit clinical reports and medical results.

Protect paper records, screens, and electronic files against unauthorized access.

Disclose medical information only where an appropriate legal basis exists, subject to applicable statutory exceptions.

Review, amend, or revoke access rights when responsibilities change or employment ends.

Maintain confidentiality obligations after employment or contractual relationships end, as applicable.

7. Health Insurance and Claims Data

Health insurance data shall be used only to the extent necessary for beneficiary eligibility, coverage verification, medical authorizations, claims, billing, and applicable audits.

MetroMed shall:

Verify beneficiary identity and required insurance details in accordance with approved procedures.

Limit information disclosed to insurers or claims administrators to what is necessary for the relevant purpose.

Transmit data through authorized systems and channels.

Restrict insurance portal access according to job responsibilities.

Prevent credential sharing where individual user accounts can be used.

Prohibit the use of diagnoses or claims data for marketing purposes.

Retain insurance documentation in accordance with applicable retention requirements.

8. Data Sharing

Where an appropriate legal basis exists, personal data may be shared, subject to data minimization, with:

Health insurers, claims administrators, and parties involved in insurance transactions.

Laboratories and healthcare providers participating in patient care.

Booking system, medical record system, hosting, and technical support providers.

Competent governmental, regulatory, or judicial authorities where disclosure is required or permitted by law.

Other parties where sharing is legally permitted and applicable safeguards are satisfied.

The purpose, scope of data, access rights, and contractual responsibilities must be defined before data is made available to third parties.

Personal data shall not be sold to third parties for commercial purposes.

9. Marketing and Promotional Communications

Marketing data shall be separated from clinical and insurance information wherever practicable.

MetroMed shall:

Not use diagnoses, laboratory results, or sensitive health information to create advertising audiences.

Not export patient lists or insurance records to advertising platforms without an appropriate legal assessment and lawful basis.

Obtain the required permissions before using patient images, testimonials, or medical stories.

Separate marketing consent from healthcare delivery procedures.

Provide an appropriate method to stop marketing communications where required by law.

Exclude sensitive clinical details from promotional messages.

Review website analytics, tracking, and advertising tools before activation.

Limit marketing team access to patient information to what is authorized and necessary for assigned duties.

10. Information Security and Data Protection

MetroMed shall implement organizational and technical measures appropriate to the nature of the data and the risks involved. These may include:

Role-based user access management.

Protection of accounts and system access credentials.

System updates and vulnerability remediation under approved procedures.

Protection of backups and paper and electronic records.

Staff awareness and training on confidentiality and data protection.

Management of risks associated with vendors and contractors processing data.

Logging and reviewing access to sensitive systems where supported by approved systems.

Handling information security incidents under approved procedures and applicable legal requirements.

11. Personal Data Incidents

Suspected data breaches, misdirected disclosures, or loss of devices containing personal data must be reported immediately through the designated internal channel.

MetroMed shall take appropriate measures to contain the incident, preserve evidence, identify affected data and individuals, assess risks, and determine whether notifications to competent authorities or affected individuals are required within applicable statutory deadlines.

Incidents, investigations, notifications, and corrective actions shall be documented to support subsequent review.

12. Data Retention and Disposal

MetroMed shall establish retention periods for each data category based on the purpose of collection and applicable legal, healthcare, and insurance requirements.

When the purpose has ended, the applicable retention period has expired, and no lawful basis remains for continued retention, the data shall be securely destroyed or de-identified as appropriate.

Medical records and other records subject to mandatory retention shall not be deleted merely because their operational purpose has ended.

Disposal activities shall be documented in accordance with approved procedures, including relevant backups and media within the approved disposal scope.

13. Transfers Outside Saudi Arabia

Before transferring personal data or making it available for processing outside Saudi Arabia, MetroMed shall identify relevant storage, processing, and remote-access locations and assess the requirements, safeguards, and conditions applicable to international data transfers.

No transfer or external access shall be approved until the required assessments, internal approvals, legal basis, and safeguards have been verified.

14. Data Subject Rights

Subject to applicable legal provisions and exceptions, individuals may exercise their statutory rights, including:

Being informed of the legal basis and purposes of processing.

Requesting access to their personal data, subject to applicable requirements.

Requesting correction, completion, or updating of inaccurate data.

Requesting destruction where no lawful basis remains for retention.

Withdrawing consent where processing is based on consent, subject to applicable legal provisions and exceptions.

MetroMed shall verify the identity or representative authority of the requester and document the request, date, actions taken, and final response.

A request for destruction does not require deletion of records that must be retained by law. Requests shall only be refused where an appropriate legal basis supports the refusal.

15. Cookies and Website Technologies

The website may use cookies and other technologies necessary for operation, security, and user experience.

Analytics, tracking, and advertising technologies shall be reviewed. Their purposes and appropriate user controls shall be explained, and applicable consent and regulatory requirements shall be implemented according to the nature and purpose of each technology.

16. Children’s Data

Children’s data shall be processed in accordance with applicable legal requirements, taking the child’s interests into account and verifying the authority of a parent, guardian, or authorized representative where required.

Appropriate safeguards shall be implemented to protect medical confidentiality and the child’s rights, according to the service and applicable requirements.

17. Policy Updates

This policy may be updated when legislation, services, technical systems, or data processing practices change.

The updated version shall be published on the website with its revision date and reviewed internally before publication to ensure consistency with MetroMed’s actual practices.

18. Privacy Contact and Requests

For privacy inquiries and data subject requests, please use the following approved contact details:

Address: Dammam, Kingdom of Saudi Arabia.

Requests shall be handled in accordance with applicable procedures and statutory deadlines.