Main Menu
Transformation Journey
Eye Health
Research Center
Physician Team
E-Services
Your Voice Service
Business Center
Introduction
King Khaled Eye Specialist Hospital and Research Center places the protection of personal data among its top priorities and is committed to implementing the Personal Data Protection Law (PDPL) issued by Royal Decree No. (M/19) dated 09/02/1443H, as amended by Royal Decree No. (M/148) dated 05/09/1444H, its Implementing Regulations, the policies and controls of the National Data Management Office (NDMO), and all other applicable laws and regulations in the Kingdom of Saudi Arabia.
It is important for beneficiaries to be aware of the types of personal data collected by the Hospital, the purposes of collection and processing, and how such data is used, in accordance with the Personal Data Protection Law and its regulations. Based on this principle, this Privacy Notice has been prepared. The Hospital encourages beneficiaries to review this Privacy Notice periodically to stay informed of any updates.
Your visit to the website of King Khaled Eye Specialist Hospital and Research Center, or your use of its platforms and applications, constitutes your acknowledgment and acceptance of the contents of this Privacy Notice and any updates thereto. This does not apply to cases where the Personal Data Protection Law permits the processing of personal data without consent.
Scope of Application
The Hospital collects the minimum necessary personal data required to achieve the purposes for which it is collected, in accordance with the Personal Data Protection Law and its regulations. Personal data may include, but is not limited to, the following categories:
• Basic personal data: such as name, gender, date of birth, and marital status.
• Contact information: such as phone numbers, email addresses, and physical address.
• Electronic account data: such as username and password used in the Hospital's systems and platforms.
• Health data: such as medical information and health records required for the provision of healthcare services.
• Educational or professional data (if applicable): such as qualifications or training information relevant to the service provided.
• Financial data: such as information required for payment or billing purposes.
• Inquiry, feedback, or complaint data.
• Geolocation data: where the user has consented to enable certain services.
• Internet network data: such as Internet Protocol (IP) address.
Definitions
• Personal Data: Any data that may lead to the identification of a natural person, directly or indirectly.
• Sensitive Personal Data: Such as health data, genetic data, and biometric data.
• Processing: Any operation performed on personal data, including collection, storage, use, sharing, or deletion.
• Data Subject: The natural person to whom the personal data relates.
• Data Controller: King Khaled Eye Specialist Hospital and Research Center.
Legal Basis for Processing Personal Data
Personal data is processed based on one or more of the following legal bases:
• Explicit consent of the data subject or their legal guardian
• Compliance with a legal or contractual obligation
• Provision of healthcare services
• Achievement of a public interest or scientific research purposes (after anonymization or de-identification)
• Protection of the life or health of the data subject
Purposes of Collecting and Processing Personal Data
The Hospital collects personal data for the following purposes:
• Providing healthcare services, diagnosis, and treatment
• Creating and managing medical records
• Scheduling and managing appointments
• Communicating with patients
• Billing and payment collection
• Compliance with legal and regulatory requirements
• Improving service quality
• Scientific research (using anonymized or de-identified data)
The Hospital adheres to the data minimization principle and does not use personal data for any undisclosed or unlawful purposes
Data Sharing and Disclosure
Personal data is shared only in the following cases:
• With the explicit consent of the data subject
• Upon request from a competent judicial or regulatory authority
• With service providers bound by contracts that ensure data protection and regulatory compliance
• For research purposes after anonymization or de-identification
• In emergency situations to protect life or health
In accordance with approved data-sharing policies, necessary personal data may be shared with authorized governmental or non-governmental entities for specific purposes based on a lawful basis or justified operational need that serves the public interest, without compromising individual privacy or national interests.
When sharing personal data, the Hospital ensures that such sharing occurs through a secure and trusted environment, with appropriate legal safeguards in place, including data-sharing agreements that ensure compliance with the Personal Data Protection Law and its regulations.
Rights of Data Subjects
Data subjects have the right to:
• Be informed about how their personal data is collected and processed
• Request access to their personal data
• Request correction or updating of their personal data
• Request deletion of their personal data once the lawful purpose no longer exists
• Withdraw consent (without affecting prior lawful processing)
• Submit a complaint to the competent authority
Data Protection and Security
The Hospital implements appropriate security measures, including:
• Data encryption
• Access control mechanisms
• Technical security systems
• Regular data backups
• Periodic security reviews
• Staff training and awareness
Cross-Border Transfer of Personal Data
Personal data is stored and processed within the geographical boundaries of the Kingdom of Saudi Arabia. Cross-border transfer of personal data is permitted only in cases allowed by the Personal Data Protection Law and its regulations, in accordance with the rules issued by the National Data Management Office, and after fulfilling all required legal conditions.
Data Retention and Disposal
• Personal data is retained only for the period necessary to fulfil the lawful purpose
• Data is securely deleted or anonymized in accordance with the data destruction guidelines approved by the National Data Management Office
Children’s Privacy
• Personal data of minors is collected only with the consent of a parent or legal guardian
• Additional safeguards are applied to protect children's data
• Children's data is not shared except as permitted by law
Cookies
The Hospital's website may use cookies to improve user experience. Users may control cookie settings through their web browser.
Contact and Complaints
For inquiries or to exercise rights related to personal data, please contact:
Data Management Office
Email: data-dept@kkesh.med.sa
The Hospital reserves the right to update this Privacy Policy and Privacy Notice when necessary. Any updates will be published on this page.
Relevant Legislation:
• National Data Governance Policies issued by the Saudi Data & Artificial Intelligence Authority (SDAIA): (Key Principles and General Rules for the Protection of Personal Data, Key Principles and General Rules for Data Sharing).
• Electronic Transactions Law.
• Anti-Cybercrime Law.
• Basic Cybersecurity Controls.