1. Introduction — About This Policy

This Privacy Notice describes how Akdital (as defined below) collects, uses, stores, shares, and protects your Personal Data when you visit or use our website, including when you submit information through our online appointment booking/contact form.

By using our website or submitting your personal information through the booking form, you acknowledge that you have read and understood this Privacy Notice. We encourage you to read it carefully before providing any Personal Data.

2. Who We Are (Data Controller)

Akdital International Company, a Saudi Joint Stock Company registered under Commercial Registration (National Unified Number) 7053693474 ("Akdital", "we", "us", or "our"), is the Data Controller responsible for your Personal Data processed through this website.

Akdital is a hospital group providing healthcare services in the Kingdom of Saudi Arabia, including outpatient consultations, specialist medical services, diagnostics, and inpatient care. Our website serves patients, prospective patients, and general visitors seeking information about our hospitals and services.

3. Contact Details and Data Protection Officer

3.1 General Contact

You may contact us regarding any matter relating to this Privacy Policy or to the processing of your Personal Data through the following channels:

Email: privacy@akdital.sa

3.2 Personal Data Protection Officer (DPO)

For further details regarding the processing of your Personal Data and how to exercise your rights, you can contact the Personal Data Protection Officer using the below contact details:

Email: privacy@akdital.sa

4. Personal Data We Collect

We collect and process the following categories of Personal Data:

4.1 Data Collected Directly via the Appointment Booking / Contact Form

When you use our online appointment booking or contact form, you are asked to provide the following information:

• Full name (Identity Data) — mandatory
• Email address (Contact Data) — mandatory
• Phone number (Contact Data) — mandatory

The above data is mandatory in order for us to process your appointment booking request.

4.2 Data Collected Indirectly (Cookies and Website Analytics)

We may also collect certain data indirectly through cookies and similar technologies when you browse our website, including your IP address, browser type, pages visited, and other usage data. For full details, please refer to Section 10 (Cookies and Similar Technologies) below.

4.4 Recruitment and Careers Data

If you apply for a position with Akdital through our Careers page or by submitting your CV or application to recruitment.hrao@akdital.sa, we may collect the following Personal Data: your full name, contact details (email address, phone number, postal address), CV/résumé, employment history, educational qualifications, professional certifications, and any other information you choose to include in your application.

We process this data for the purpose of evaluating your application, managing our recruitment process, and communicating with you regarding current or future vacancies.

4.5 Automated Decision-Making and Profiling

Akdital does not currently use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Should this change in the future, we will update this Privacy Policy accordingly and, where required by the PDPL, obtain your prior consent before any such processing takes place.

5. How We Collect Your Personal Data and Why (Purposes)

5.1 Direct Collection

We collect Personal Data directly from you when you voluntarily submit information through the online appointment booking/contact form on our website. The form uses clearly labelled empty fields through which you enter your data.

The purpose of collecting this data directly is to handle and respond to your appointment booking request, and to facilitate related communications (e.g., confirming or arranging appointments, responding to your enquiries).

5.2 Indirect Collection

We collect certain data indirectly through cookies and website analytics technologies when you access and browse our website. Please see Section 10 (Cookies and Similar Technologies) for details on these collection methods and their purposes.

5.3 Recruitment and Careers Data

We collect this Personal Data directly from you when you apply for a position through our Careers page or by submitting your CV or application to recruitment.hrao@akdital.sa. We process this data to evaluate your application, manage our recruitment process, and communicate with you regarding current or future vacancies.

6. Legal Basis for Processing

In accordance with the Personal Data Protection Law, we rely on the following legal bases for collecting and processing your Personal Data:

6.1 Consent

For the collection of your data via the appointment booking/contact form, our primary legal basis is your consent. By completing and submitting the form, you consent to the collection and processing of your Personal Data for the purposes described in this Privacy Policy.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal or processing based on other legal bases. To withdraw consent, please contact us using the details in Section 3 above.

Where we use your contact details for direct marketing, the legal basis for that processing is your prior consent. You may withdraw your consent at any time; withdrawal will not affect the lawfulness of processing carried out prior to withdrawal.

6.2 Other Legal Bases

Depending on the circumstances, we may also rely on one or more of the following legal bases:

• Performance of a contract or agreement to which you are a party (e.g., where an appointment confirmation constitutes an agreement for services);
• Protection of public health or safety, or preservation of vital interests of individuals (preserving health or protecting lives);
• Legitimate interests of the Controller, provided such interests do not override your rights as a Data Subject (e.g., evaluating your job applications). For the avoidance of doubt, we do not rely on legitimate interest as a legal basis for processing Sensitive Data (including health data); where Sensitive Data is processed, we obtain your explicit consent or rely on another legal basis permitted under the PDPL for such data;
• Compliance with a legal or regulatory obligation applicable to Akdital.

7. How We Use Your Personal Data

We use the Personal Data collected, directly or indirectly, for the following purposes:

• Contacting you to confirm, arrange, or reschedule appointment bookings;
• Responding to your enquiries or requests submitted through the contact/booking form;
• Administrative purposes related to managing your booking and our services;
• Improving our website and services through aggregated analytics data (see Section 10);
• Evaluating job applications, managing our recruitment process, and communicating with applicants regarding current or future vacancies;
• Subject to your prior consent, sending you marketing communications about our healthcare services, promotions, health awareness campaigns, and other information that may be of interest to you. You may withdraw your consent to receive marketing communications at any time by using the unsubscribe link included in each communication or by contacting us using the details in Section 3. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

We will not use your Personal Data for purposes incompatible with those for which it was originally collected, unless a new legal basis applies and you are informed accordingly.

8. How We Share / Disclose Your Personal Data

We will not disclose your Personal Data to any third party for direct marketing purposes.

We may disclose your Personal Data to the following categories of recipients, solely for the purposes described in this Privacy Policy:

• Third-party booking/appointment management service provider, for the purpose of processing and managing your appointment booking. This disclosure is regular (ongoing) as it occurs each time a booking is submitted;
• IT hosting and email service providers, for the purpose of operating and maintaining our website and communicating with you.

All third parties with whom we share your Personal Data are contractually obligated to process it only on our instructions, to maintain its confidentiality, and to implement appropriate security measures.

9. International / Cross-Border Data Transfers

The third-party booking provider/processor through which your appointment data is managed may be located outside the Kingdom of Saudi Arabia.

Certain website functionality is also provided by third parties whose infrastructure may be located outside the Kingdom of Saudi Arabia, including Google Maps (used to display our hospital locations) and Google Fonts (used to display certain typefaces). Loading these features may result in limited technical data (such as your IP address) being processed outside the Kingdom.

Any transfer of your Personal Data outside the Kingdom of Saudi Arabia will be carried out in compliance with the PDPL, its Implementing Regulations, and the Regulation on Personal Data Transfer Outside the Kingdom, including through the safeguards recognised under those instruments (such as standard contractual clauses or equivalent mechanisms with our processors).

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies to enhance your browsing experience and to help us understand how our website is used. A cookie is a small text file stored on your device when you visit a website.

We use strictly necessary cookies (which do not require consent) as well as analytics, functional, and marketing cookies (which are set only with your prior consent), including cookies placed by Google Analytics 4 and Microsoft Clarity for website analytics purposes.

For full details of the cookies we use, their purposes, durations, and how to manage your preferences or withdraw consent, please refer to our separate Cookie Policy.

When you first visit our website, a cookie consent banner will be displayed, allowing you to accept or reject non-essential cookies. You can change your preferences at any time through the cookie preference centre accessible via the website footer or the cookie banner.

Our website also embeds functionality from third-party providers, including Google Maps (to display our hospital locations) and Google Fonts (to display certain typefaces), and includes links to Akdital's social media profiles hosted on third-party platforms. These third-party providers and platforms operate under their own privacy policies and terms.

Our website may contain links to third-party websites or services that are not operated by Akdital. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We encourage you to review the privacy policy of every website you visit. The inclusion of a link to a third-party website does not imply endorsement of the linked website or its content by Akdital.

11. How We Store and Retain Your Personal Data

11.1 Storage Location

Your Personal Data is stored securely, with appropriate technical and organisational access controls and safeguards in place to protect it from unauthorised access, loss, or misuse.

11.2 Retention Period

We retain your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. Specifically:

• Appointment booking data (name, email, phone number) is retained only for as long as necessary to process your booking and any related follow-up, after which it is securely destroyed;
• Recruitment data (CVs and job applications) is retained only for as long as necessary to evaluate your application and conduct the recruitment process, after which it is securely destroyed unless you consent to us retaining your data for consideration for future positions.

11.3 Destruction

Once the purpose for which Personal Data was collected has been fulfilled and the retention period has expired, we securely destroy the data using appropriate technical and organisational deletion methods, such that it cannot be viewed, accessed, or recovered.

12. How We Protect Your Personal Data (Security Measures) and Data Breach Notification

12.1 Security Measures

We are committed to protecting your Personal Data from unauthorised access, disclosure, alteration, loss, or destruction. Given the healthcare context and the sensitivity of the data we may process, we implement administrative, technical, and organisational security measures proportionate to the sensitivity and volume of Personal Data, including but not limited to:

• Encryption of Personal Data in transit and at rest;
• Access controls and authentication mechanisms to restrict access to authorised personnel only;
• Anonymisation and pseudonymisation techniques where appropriate;
• Regular security assessments and audits;
• Staff training on data protection and information security;
• Physical security measures for premises where data is stored.

The level of security measures applied is commensurate with the sensitivity and amount of Personal Data collected and processed.

12.2 Data Breach Notification

In the event of a Personal Data breach that is likely to cause harm to the Data Subject or conflict with their interests or rights, Akdital will notify the Competent Authority within seventy-two (72) hours of becoming aware of the breach. Where the breach is likely to cause serious harm to the Data Subject, Akdital will also notify the affected Data Subjects without undue delay. The notification will include the nature of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

13. Your Rights

Under the Personal Data Protection Law, you have the following rights regarding the processing of your Personal Data. These rights primarily depend on the purpose of collection and processing:

(1) Right to Be Informed

You are entitled to be informed of the legal basis for, and purpose of, collecting your Personal Data, how it is processed, stored, destroyed, and to whom it will be disclosed. You can access all such details through this Privacy Policy or by contacting us using the details in Section 3.

(2) Right of Access

You are entitled to request access to the Personal Data we hold about you by submitting a written request using the contact details in Section 3.

(3) Right to Request Access in a Readable Format

You are entitled to request access to your Personal Data held by us in a readable and clear format consistent with the content of records, whether in a commonly used electronic format if technically feasible, or as a printed hard copy.

(4) Right to Request Correction, Completeness, and Update

You are entitled to request the correction of your Personal Data that you believe is inaccurate, incorrect, or incomplete. Such data will be reviewed and updated within 30 days of receiving your request.

(5) Right to Request Destruction / Erasure

You are entitled to request the destruction of your Personal Data held by us where it is no longer necessary to achieve the purpose for which it was collected, subject to applicable legal retention requirements.

(6) Right to Withdraw Consent

You are entitled to withdraw your consent for Personal Data processing at any time, unless there is another legal basis that requires otherwise. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. To withdraw consent, please contact us using the details in Section 3.

(7) Right to Object to Processing

You have the right to object to the processing of your Personal Data in certain circumstances as provided under the PDPL.

(8) Right to Submit a Complaint to the Competent Authority

You have the right to submit a complaint to the Competent Authority (SDAIA) relating to the application of the provisions of the PDPL. See Section 14 below for details.

(9) Right to Claim Compensation

You have the right to claim compensation for material or moral damage if you are harmed as a result of any violation of the PDPL or its Implementing Regulations.

14. Complaints and Objections

14.1 Internal Complaints Mechanism

If you have any concerns about how we process your Personal Data, or if we fail to enable you to exercise your rights within the specified period, you may file a complaint with:

• Contact channels: privacy@akdital.sa

14.2 Escalation to the Competent Authority

If you are not satisfied with how we process your complaint, or if we fail to respond within the timeframe stated above, you may file a complaint with the Competent Authority:

Please note that complaints to the Competent Authority must be submitted within ninety (90) days from the date of the occurrence of the alleged violation, or from the date on which the Data Subject becomes aware of it, whichever is later.

• Saudi Data & AI Authority (SDAIA)
• Location: Kingdom of Saudi Arabia, Riyadh
• Website: Saudi Data & AI Authority (sdaia.gov.sa)
• National Data Governance Platform "DGP": dgp.sdaia.gov.sa

15. Children's and Vulnerable Persons' Data

We recognise that Personal Data relating to children (persons under 18 years of age), elderly persons, or persons with disabilities may be processed in connection with appointment bookings or medical services.

Where we process the Personal Data of a child, we will require the consent of the child's parent or legal guardian before collecting or processing such data. We take appropriate care to ensure that the rights of vulnerable Data Subjects are protected in accordance with the PDPL and its Implementing Regulations.

16. Changes to This Privacy Policy

We periodically review this Privacy Policy and may update it from time to time to reflect changes in our processing activities, legal requirements, or best practices. Any amendments will be recorded in the update history below.

Where changes are material, we will take reasonable steps to notify you (for example, by posting a prominent notice on our website or sending a notification).

The date of the most recent update is indicated at the top of this Privacy Policy.

Update Record

• Version 1.0 — 16 September 2026 — Initial publication

17. How to Access This Policy

This Privacy Policy is made available to Data Subjects on our website prior to and during the collection of Personal Data. You can access this Privacy Policy at any time via the dedicated link in the footer of our website.

We may also provide you with a summary notice or link to this Privacy Policy at the point of data collection (e.g., on the appointment booking form) to ensure you are informed before submitting your Personal Data.

18. Contact Us

If you have any questions about this Privacy Policy, your Personal Data, or wish to exercise any of your rights, please contact us:

• Data Controller:
  Akdital International Company
  Al Zonboq Street, Al Olaya District, Building No. 3906, Riyadh 12333, Kingdom of Saudi Arabia
  Commercial Registration (CR) / National Unified Number: 7053693474
• General Privacy Enquiries:
  Email: privacy@akdital.sa
• Data Protection Officer:
  Email: privacy@akdital.sa
• Complaints:
  Email: privacy@akdital.sa

— End of Privacy Policy —