Sehhatek Application Privacy Policy

How Sehhatek collects, uses, protects, and shares the personal data of Ministry of Defense beneficiaries, in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia.

Issued By: Ministry of Defense
Applies To: Eligible MoD Beneficiaries

1. Introduction

Sehhatek (“Sehhatek,” “the Application,” “the Platform,” “We,” “Us,” or “the Administration”) is a digital healthcare application made available by the Ministry of Defense (“MoD”) to eligible MoD beneficiaries (“You,” “User,” or “Users”) for the purpose of accessing certain digital healthcare services.

The Administration is committed to protecting the privacy and confidentiality of the personal data of Users collected and processed through Sehhatek, and to handling such data in a manner consistent with the applicable laws and regulations of the Kingdom of Saudi Arabia (“the Kingdom”), including the Personal Data Protection Law and its Implementing Regulations (“PDPL”).

This Privacy Policy (“Policy”) explains what personal data Sehhatek collects, how it is used, the legal basis for such use, with whom it may be shared, and the rights available to Users in respect of their personal data. This Policy should be read together with Sehhatek’s Terms of Use. Any capitalized term not otherwise defined in this Policy shall have the meaning given to it in the Terms of Use.

By registering for, accessing, or using Sehhatek and submitting personal data through the Application, You acknowledge that You have read and understood this Policy, and You agree to the storage, processing, and use of Your personal data by the Administration and relevant Saudi authorities, including the Ministry of Defense, for the purposes described herein.

2. Legal Basis for Collecting and Processing Your Personal Data

We collect, process, share, and use Your personal data on the following legal bases:

• Contractual Necessity: To fulfil our obligations to You in providing the digital healthcare services made available through Sehhatek, including access to relevant health information.
• Legal Compliance: To comply with applicable regulatory requirements, including those of the Ministry of Defense, the Ministry of Health, and other competent authorities, as well as the PDPL and any related legislation.
• Vital Interests: Where processing Your data is necessary to protect Your vital interests or those of another individual.
• Public Interest: Where processing is necessary for reasons of public interest, including public health and national security.
• Consent: Where You have provided explicit consent for a specific purpose that is not otherwise covered by the bases above.

3. Information We Collect

We collect the following categories of personal data in connection with Your registration for and use of Sehhatek:

a. Identity and Account Information

Full name, national ID or military/beneficiary identification number, date of birth, gender, and other identifying information necessary to verify Your eligibility as an MoD beneficiary.

b. Health Information

Health-related information made available to You through Sehhatek in connection with the healthcare services You are eligible to receive, which may include (as applicable to the features enabled within the Application):

• Appointment details and history
• Prescription and medication information
• Laboratory test results
• Radiology test results
• Clinical summaries and notes made available to You
• Other health record information relevant to the services provided through Sehhatek

c. Contact Information

Mobile number, email address, and mailing/national address, where provided.

d. Technical and Device Information

Device type, operating system, application version, language settings, IP address, and similar technical information generated through Your use of the Application.

e. Usage Information

Information relating to Your interaction with Sehhatek’s features, such as login activity, session information, and general usage patterns, collected to maintain and improve the Application.

We do not collect personal data beyond what is reasonably necessary for the purposes described in this Policy. You are solely responsible for the completeness, accuracy, and truthfulness of the data You submit through Sehhatek.

4. How We Collect Your Personal Data

We collect Your personal data through the following means:

• Directly from You: Information You provide when registering for or using Sehhatek, including through account setup and identity verification.
• Through Authentication Services: Where Sehhatek integrates with government-approved identity verification services (such as Nafath) to confirm Your identity and eligibility as an MoD beneficiary.
• Through Ministry of Defense Health Information Systems: Health-related information made available to Sehhatek from healthcare facilities, records systems, and information systems operated by or on behalf of the Ministry of Defense, for the purpose of displaying relevant health information to You within the Application.
• Automatically: Certain technical information (such as IP address, device identifiers, and application logs) is collected automatically when You access or use Sehhatek, to support functionality, security, and performance monitoring.

Sehhatek does not integrate with third-party consumer health platforms, and does not collect personal data from sources other than those described above unless You are separately notified and, where required, your consent is obtained.

5. Purposes of Processing

Your personal data is collected and processed for the following purposes:

• To verify Your identity and eligibility to access Sehhatek as an MoD beneficiary.
• To provide, operate, and maintain the digital healthcare services made available through Sehhatek, including viewing healthcare information, appointments, prescriptions, and laboratory or radiology results, and enabling appointment booking where such a feature is available.
• To communicate with You regarding Your account, appointments, or requests, including through notifications, text messages, or calls.
• To respond to inquiries, complaints, or requests for support.
• To maintain, secure, and improve the performance of Sehhatek, including troubleshooting, testing, and quality management.
• To detect, investigate, and prevent misuse of the Application or breaches of this Policy or Sehhatek’s Terms of Use.
• To comply with applicable legal, regulatory, and Ministry of Defense requirements, including satisfying any law, regulation, or lawful governmental request.
• For any other lawful purpose disclosed to You at or before the time Your data is collected, and to which You have consented, where such consent is required.

We may use Your personal data in an aggregated and/or de-identified form for the purpose of service improvement, statistical analysis, and reporting, in a manner that does not identify You.

6. Data Sharing and Disclosure

We treat Your personal data as confidential and do not share or disclose it except as described below.

a. Within the Ministry of Defense Healthcare Ecosystem

Your health-related information may be shared with, or accessed from, healthcare facilities and information systems operated by or on behalf of the Ministry of Defense, to the extent necessary to provide the services available through Sehhatek and to support Your continuity of care.

b. Other Government Agencies

Where necessary to serve You in an efficient and effective manner, we may share Your personal data with other competent government agencies, in accordance with the Administration’s applicable data-sharing arrangements and governance requirements.

c. Non-Governmental Entities

We will not share Your personal data with non-governmental entities, except where such entities have been specifically authorized by the competent authorities to receive such data in accordance with the Administration’s applicable data-sharing arrangements, and subject to appropriate confidentiality obligations, including non-disclosure agreements where relevant.

d. Service Providers and Contractors

We may share personal data with contractors and service providers engaged to support the operation, hosting, maintenance, or security of Sehhatek, strictly to the extent necessary to perform such services and subject to confidentiality obligations.

e. Legal and Safety Reasons

We reserve the right at all times to disclose Your personal data to competent authorities as necessary to satisfy any applicable law, regulation, or lawful governmental request, or where We believe in good faith that disclosure is necessary to protect vital interests, public health, or national security.

We do not sell Your personal data, and we do not share it with third parties for marketing purposes.

7. Data Retention

We retain Your personal data, including health data, only for as long as necessary to fulfil the purposes described in this Policy, or as required to comply with applicable legal, regulatory, or record-keeping obligations.

Where regulatory requirements prevent the deletion of certain data (particularly health records), such data will be retained for the minimum period required, its use and display will be restricted to what is mandated by applicable regulations, and it will be anonymized where feasible.

Where You request deletion of Your account, we will take reasonable steps to delete or anonymize Your personal data, except where retention is required by law or by applicable Ministry of Defense record-keeping obligations.

8. Security Measures

We implement organizational, administrative, and technical measures designed to protect Your personal data against unauthorized access, use, alteration, or destruction. All electronic storage and transmission of Your personal data is secured using appropriate security technologies, including, without limitation:

• Restricting access to identifying and health data to authorized personnel on a need-to-know basis.
• Data encryption and other technical safeguards appropriate to the sensitivity of the data involved.
• Logging and monitoring of access to personal data for audit purposes.
• Periodic internal review of security practices and access controls.
• Training of relevant personnel on data privacy and confidentiality obligations.

Access to Your health data is limited to individuals with the appropriate authority to view such data, such as treating healthcare practitioners, or as otherwise required by applicable law.

9. International Transfers of Personal Data

Your personal data is processed and stored within the Kingdom of Saudi Arabia. We will not transfer or disclose Your personal data outside the Kingdom unless such transfer is permitted under the PDPL and its Implementing Regulations, and either Your explicit consent has been obtained or the approval of the competent authority has been secured, where required.

10. Children’s Data

Sehhatek is intended for use by eligible adult MoD beneficiaries. Where a User accesses or manages data relating to a dependent who is under eighteen (18) years of age, or who lacks legal capacity, the User confirms that they are the lawful guardian of such dependent and consents, on the dependent’s behalf, to the collection and processing of the dependent’s personal data in accordance with this Policy. The Administration may request evidence of guardianship where necessary.

11. Your Rights Under the PDPL

Subject to the retention and legal considerations described in this Policy, You have the right, at any time, to:

• Be informed of the purpose and legal basis for collecting and processing Your personal data.
• Access Your personal data and obtain a copy of it.
• Request correction, completion, or updating of Your personal data.
• Request deactivation of Your account, unless there is a legal justification to maintain it, including where Your data is linked to a matter pending before a judicial or regulatory authority.
• Withdraw Your consent to processing, where processing is based on consent, unless there is a legal justification preventing such withdrawal.

To exercise any of these rights, please contact us using the details in Section 16 below. We may request additional information to verify Your identity or to process Your request.

12. Your Responsibilities as a User

You are solely responsible for ensuring that the personal data You submit through Sehhatek is complete, accurate, and truthful, and for promptly updating any information that changes. To help protect Your personal data, We recommend that You:

• Contact us immediately if You believe someone has gained unauthorized access to Your data or Your account.
• Avoid disclosing confidential or personal information over the phone or the internet unless the recipient’s identity has been verified.
• Use a secure and updated device and application version, avoid leaving Your session active on shared devices, and keep any device security software up to date.
• Keep Your contact information on Sehhatek current at all times.

13. Cookies and Analytics

Sehhatek may use limited technical identifiers and analytics tools to understand application performance, diagnose technical issues, and improve the User experience. Such information may include device type, operating system, application version, and general usage patterns. This information is used solely to support the operation and improvement of Sehhatek and is not used for advertising or shared with third parties for marketing purposes.

14. External Links

Sehhatek may, from time to time, contain links to third-party websites, portals, or services whose data protection and privacy practices may differ from ours. Such links are provided for Your convenience only. We are not responsible for the content or privacy practices of any linked third-party site or service, and We advise You to review the privacy notices of those sites before providing any personal data to them.

15. Changes to This Policy

We reserve the right to amend this Policy at any time to reflect changes in our practices, legal requirements, or the services offered through Sehhatek. Where required, You will be notified of material changes and, where applicable, Your renewed consent will be sought. Continued use of Sehhatek following notification of changes constitutes acceptance of the updated Policy. If You do not accept an updated Policy, we reserve the right to suspend or terminate Your access to Sehhatek.

16. Contact Information

If You have questions about this Policy, or wish to exercise any of the rights described in Section 11, please contact us at:

Email: [email protected]

Issue number: 1.0

Effective date: 29- July- 2026