Privacy Policy
1. Scope
This policy applies to personal data MedFlow processes in connection with its website, business relationships, and the software it provides to healthcare and research institutions in the Kingdom.
2. Our role: controller and processor
For clinical deployments, the hospital or institution is the data controller and MedFlow acts as a processor, handling personal data only on the controller's documented instructions. For our own website and business contacts, MedFlow is the controller.
3. Personal data we process
Business contact data you provide to us, such as name, work email, organization, and role. In clinical deployments operated by our customers, the software processes patient health data, which is treated as sensitive personal data under the PDPL and given heightened protection.
4. Legal basis for processing
We process personal data on a lawful basis under the PDPL, which may include your consent, performance of a contract, compliance with a legal obligation, or a legitimate interest that does not override the rights of the data subject. Sensitive data, including health data, is processed only where a specific lawful basis applies.
5. Health and sensitive data
Health, genetic, and biometric data are sensitive personal data under the PDPL. Access is restricted to the minimum necessary, and such data is not used for purposes incompatible with those for which it was collected by the controlling institution.
6. On-premises processing and de-identification
MedFlow is designed to process clinical data inside the customer's own environment. Where the software performs de-identification, it runs within that environment so that identifiers are removed before data is used for research, quality, or reporting.
7. Data residency
MedFlow supports deployments that keep personal data within the Kingdom, on infrastructure that meets MOH, SDAIA, and applicable cloud-governance hosting requirements for health data.
8. Cross-border transfers
MedFlow does not transfer personal data outside the Kingdom except where permitted by the PDPL and its Data Transfer Regulation, for example to a jurisdiction with an adequate level of protection or under approved safeguards such as standard contractual clauses, supported by a transfer risk assessment. The PDPL continues to apply to data after any such transfer.
9. Your rights
Subject to the PDPL, you have the right to be informed of how your data is processed, to access your data and obtain a copy of it, to request correction of inaccurate or outdated data, to request its destruction, and to withdraw consent. To exercise these rights, contact us using the details below.
10. Data retention
Business contact data is retained only as long as needed for the purposes described here. In clinical deployments, retention of patient data is determined by the controlling institution under its agreement and applicable Saudi regulations.
11. Security
We apply technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, role-based access control, and audit logging. Customers remain responsible for controls within their own environments.
12. Personal data breach
Where MedFlow becomes aware of a personal data breach in its capacity as controller, it will notify SDAIA without undue delay and within the period required by the Implementing Regulations, and will inform affected data subjects where the breach is likely to cause them serious harm. When acting as a processor, MedFlow will notify the controller promptly.
13. Data Protection Officer and records
MedFlow maintains records of its processing activities and, where required by the PDPL, registers as a controller and appoints a Data Protection Officer. You can reach our data protection contact at the address below.
14. Sharing and disclosure
We share personal data only with processors acting on our behalf under written agreement, where required by Saudi law or a competent authority, or as directed by the controlling institution, including exchange through national health platforms such as NPHIES where applicable.
15. Changes and contact
We may update this policy as our products or legal obligations change. Questions or rights requests can be sent to support@medflow.sa.