Privacy Policy
At Almather Hospital, by King Faisal Specialist Hospital & Research Centre (“KFSH&RC”), we are committed to providing exceptional healthcare services while adhering to the highest professional standards. As part of a leading healthcare organization, we recognize the importance of protecting your personal information. This Privacy Policy is designed to transparently present our practices regarding the collection, use and protection of personal data in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 09/02/1443H and its implementing regulations in the Kingdom of Saudi Arabia and the standards of the National Data Management Office. Understanding and respecting your privacy rights is the foundation of our relationship with you, and we assure you that your trust is our priority. If you have any questions or concerns, you can contact us using the information provided below.
1. WHO WE ARE, CONTACT DETAILS AND SCOPE
Almather Hospital is a private hospital in Riyadh operating within the KFSH&RC ecosystem. This website (almather.kfshrc.edu.sa) is operated by (“Almather Hospital”, “the Hospital”, “we”), which is the Personal Data Controller for personal data processed through this website.
Contact details: Altakhassusi Street, Al Maather, Riyadh 12714, Kingdom of Saudi Arabia — Telephone: +966 11 515 2222 — Email: almather_info@kfshrc.edu.sa
This Privacy Policy covers personal data processed through this website and, at a general level, personal data processed by the Hospital in providing healthcare services. Two related services have their own privacy documents: the “Book an Appointment” service is provided through the Almather Hospital Patient App, which is governed by the Almather Hospital Patient App Terms of Use and Privacy Policy; and career applications are submitted through the KFSH&RC e-recruitment system, which is governed by KFSH&RC’s applicable privacy notices. Please review those documents when you use those services.
2. WHAT PERSONAL DATA IS COLLECTED?
We gather and work with the following kinds of information:
1. Personal Data: Name, date of birth, national or residency ID, static or moving images of individuals.
2. Contact Data: Phone number, mobile number, email address, home address.
3. Health Data: Medical history details, test results, treatment plans, medications, and other health-related data collected in the course of providing care.
4. Financial Data: Bank account details, payment information, health insurance details, credit or debit card numbers, where required for hospital services. Payment details are not collected through this website.
5. Consent Data: Explicit consent regarding the collection and processing of personal data, as required by the Personal Data Protection Law.
6. Website Enquiry Data: Information you submit through the “Send Enquiry” form on this website — your full name, phone number, email address, the speciality you are interested in, and any message you choose to write.
7. Technical Data: Information collected automatically when you visit this website, such as your IP address, device and browser type, language settings, pages visited and access logs. The website uses cookies and similar technologies that are necessary for it to function and to protect it. We do not currently use analytics or advertising cookies on this website; if that changes, this Policy will be updated and any legally required consent mechanism will be provided before such technologies are used.
3. HOW DO WE COLLECT YOUR PERSONAL DATA? WHAT IS THE PURPOSE FOR COLLECTION?
All personal data we process is obtained directly from you, using the information you provide. This includes personal, health and other data shared during your hospital visit, consultations, or when filling out registration forms for treatments and procedures, to improve hospital administrative processes and manage your healthcare effectively. You are contacted regarding appointments and matters related to your care using available communication methods. Health data may be shared between different providers to ensure continuity of treatment. Health data also contributes to medical research and is used to comply with legal requirements related to public health and safety. We also obtain personal data indirectly from external sources, such as health insurance companies, government databases (for identity verification purposes), and other healthcare providers who share medical records when needed to ensure continuity of care.
Through this website, we collect personal data when you submit the “Send Enquiry” form or contact us using the published contact details, so that we can respond to your enquiry and direct it to the appropriate department. Please note that the speciality you select and anything you write in the message field may reveal information about your health. Please do not include detailed medical information, test results or urgent medical questions in the website enquiry form; for medical matters, contact the Hospital directly or use the Almather Hospital Patient App. Enquiry submissions that reveal health information are protected to the same standard as health data.
This website is directed at the general public and is not intended to collect personal data from children. If an enquiry concerns a child, it should be submitted by a parent or legal guardian.
4. HOW DO WE USE YOUR PERSONAL DATA?
At Almather Hospital, we are committed to using your data responsibly to provide the best possible care and ensure smooth operations. We use your data to coordinate your treatment with our medical team and external healthcare providers, to ensure that care is provided in an integrated manner. Your health data is also used for billing purposes. In addition, we use your data to improve the quality of care we provide, review staff performance, and for training and education purposes. We participate in health data exchanges to transfer your data, as permitted by law, with other healthcare providers to improve treatment and coordinate care, and we conduct research while ensuring strict privacy protections are in place. Finally, we comply with regulatory requirements to disclose your health data for public health, legal, or regulatory reasons when necessary.
We use website enquiry data to respond to your enquiry, direct it to the relevant department, and follow up with you about your request. We use technical data to operate, secure, maintain and improve this website.
5. HOW DO WE STORE YOUR PERSONAL DATA?
Personal data held in the Hospital’s healthcare systems is securely stored within the Kingdom of Saudi Arabia. This website is hosted within the Kingdom of Saudi Arabia. Personal data will be retained as long as necessary to fulfill the purpose for which it was collected, unless a longer retention period is required to comply with applicable laws, legal purposes, or regulations set by relevant authorities; information that forms part of a medical record is retained for the periods required by healthcare regulations and cannot be deleted merely upon request. Data is protected using advanced technologies in line with the policies of the National Cybersecurity Authority and other relevant regulations. Once the retention period ends, data will be securely disposed of in accordance with the law and in compliance with the provisions of Article (18) of the Personal Data Protection Law.
6. HOW DO WE DISCLOSE YOUR PERSONAL DATA?
1. Healthcare Providers: Sharing your health data with healthcare specialists involved in your treatment to ensure continuity of care.
2. Insurance Companies: Sharing financial and health data with insurance companies for payment and coverage purposes.
3. Government Entities: Sharing personal data as required by law when necessary.
4. Consent-Based Sharing: We may share your personal data with research institutions to support medical studies aimed at improving treatments and healthcare solutions, where a valid legal basis (including your consent, where required) exists.
5. Service Providers: Companies that help us operate this website and our digital services under contract and under our instructions — such as the website development and maintenance provider, hosting and content-delivery/security providers, and the technology platform provider for the Almather Hospital Patient App. These providers may process personal data only to provide their services to us.
We do not sell personal data, and we do not share it with third parties for their own unrelated purposes.
7. LEGAL BASIS FOR COLLECTING AND PROCESSING YOUR PERSONAL DATA
In accordance with the Personal Data Protection Law, the legal bases on which we rely in processing personal data are:
1. Vital Interest: Any interest necessary to preserve the life of a Data Subject.
2. Actual Interest: Any moral or material interest of the Data Subject that is directly linked to the purpose of processing personal data, where the processing is necessary to achieve that interest — such as responding to an enquiry you submit through this website.
3. Legitimate Interest: Any necessary interest of the Controller that requires the processing of personal data for a specific purpose, provided it does not adversely affect the rights and interests of the Data Subject — such as securing and improving this website. We do not rely on legitimate interest to process sensitive data, including health data.
4. Explicit Consent: Direct and explicit consent given by the Data Subject in any form that clearly indicates acceptance of the processing of their personal data in a manner that cannot be interpreted otherwise, and whose obtention can be proven. Where consent is the basis, you may withdraw it at any time.
5. Compliance with Legal Obligations: Processing necessary for the Hospital to comply with the laws, regulations and orders of competent authorities in the Kingdom of Saudi Arabia.
8. HOW WE PROTECT AND HANDLE YOUR PERSONAL DATA
We apply appropriate administrative, organizational, physical and technical safeguards designed to protect the personal data we hold, in accordance with the Personal Data Protection Law and applicable cybersecurity requirements. Access to personal data is limited to those who need it to perform their duties, and everyone at Almather Hospital who handles personal data is bound by confidentiality obligations and follows strict rules to keep your data protected. We review and update our security measures periodically. No website or transmission over the internet can be guaranteed to be completely secure, and we work to reduce these risks substantially. If a breach of personal data occurs that is subject to notification requirements, we will notify the Competent Authority and, where required, affected individuals, in accordance with the Personal Data Protection Law and its regulations.
9. MARKETING COMMUNICATIONS, THIRD-PARTY LINKS AND EXTERNAL SERVICES
We may occasionally wish to notify you of healthcare products and services available at the Hospital. We will send such marketing or promotional communications only in accordance with applicable law and any required consent, and you will be able to opt out of them at any time without affecting your care or our response to your enquiries. Communications sent to respond to your enquiry or in connection with your care are not marketing.
This website contains links to external websites and services, including the Almather Hospital Patient App (for appointment booking) and the KFSH&RC e-recruitment system (for career applications), each governed by its own terms and privacy documents, as well as any other external sites we may link to. We are not responsible for the content or privacy practices of external websites, and we advise you to review their privacy notices before providing personal information to them.
10. YOUR RIGHTS REGARDING PROCESSING OF YOUR PERSONAL DATA
Under the Personal Data Protection Law, you have the following rights:
1. You have the right to be informed why we are collecting your personal data and what rules we are following.
2. You have the right to access your personal data that we hold about you.
3. You have the right to request your personal data that we hold about you in a readable and clear format.
4. You have the right to request correcting, completing, or updating your personal data held by us.
5. You have the right to request the destruction of your personal data held by us, where destruction is legally permitted. Information that must be retained under applicable laws or medical-record requirements (see Section 5) cannot be destroyed merely upon request.
6. You have the right to withdraw your consent for processing your personal data at any time. Withdrawal shall not affect the processing of personal data that is based on another legal basis as listed herein.
Exercising your rights is free of charge except where the law permits otherwise. We will verify your identity before acting on a request and respond within the timeframes required by the Personal Data Protection Law. If you are not satisfied with our response, you may submit a complaint to the Competent Authority (the Saudi Data & Artificial Intelligence Authority — SDAIA) in accordance with the law.
11. CONTACT US ABOUT YOUR PERSONAL DATA
To learn more about how we handle your personal data, to exercise your rights, or to raise a complaint, you can reach out to almather_info@kfshrc.edu.sa
12. DATE OF LAST UPDATE AND CHANGES TO THIS POLICY
This Privacy Policy was last updated on August 1, 2026. We may update this Policy from time to time — for example, when the website changes or the law requires it. We will publish the updated Policy on this page with its updated date, and we will inform you of material changes by reasonable means.
