Arwad Virtual Clinic

Arwad Virtual Clinic delivers medical care remotely, which means our relationship with you begins and continues through digital channels. Because what you share with us concerns your health, protecting it is part of our professional duty to you rather than an administrative formality. This policy explains what we collect and why, who sees it, where it is kept, and what rights the Personal Data Protection Law gives you.

Your data stays in the Kingdom: your health data is held on servers inside Saudi Arabia, in line with Ministry of Health telemedicine requirements.

We do not record consultations: no session is recorded in audio or video without your explicit prior consent. What is kept is what the physician writes in the record.

Your record belongs to you: you may request a copy of your file, or ask us to correct what it contains, at any time.

1. Who we are

Arwad Virtual Clinic is a licensed clinic operating under the legal entity Arwad Company Commercial, based in Al Awali District, Najm Al-Din Al-Ayyubi Street, Riyadh. Commercial Registration 1010274906, Unified National Number 7011986267, Ministry of Health licence 1400091293. The company is the controller of your personal data within the meaning of the Personal Data Protection Law.

2. What we collect

Identity data: name, national ID or iqama number, and date of birth. We need the ID number for two regulatory reasons: tying the medical record to one person without ambiguity, and applying the state’s assumption of VAT on behalf of Saudi citizens.

Contact data: mobile number, email address, and city.

Health information: your presenting complaint, medical history, medications, allergies, and any reports, test results or images you send us.

Consultation record: the physician’s notes, diagnosis, care plan, prescriptions, and referrals.

Payment data: the fee, payment status, and transaction reference. We never see or store your card number, as payment is taken directly by the approved payment gateway.

Technical data: the time and duration of the session, device type, and the connection logs needed to run the call and troubleshoot it.

3. Booking on behalf of a patient

Many of our patients are older adults, and a family member or caregiver may make the booking. In that case we collect the requester’s details and their relationship to the patient alongside the patient’s own information.

The patient remains the owner of the medical record and the person entitled to see it. Consultation details are not shared with anyone else without the patient’s permission, or under a legal guardianship.

4. Why we use your information

We use your information to deliver the consultation and produce the care plan, prescription and report; to create and maintain your medical record as the Ministry of Health requires; to contact you about your appointment and the free fourteen-day follow-up review; to issue the tax invoice and process payments and refunds; and to review service quality internally, in a form that does not identify you wherever that is possible.

Sending you updates or offers rests on your consent alone. You may withdraw it whenever you wish, and doing so will not affect your medical care in any way.

5. Video consultations

No consultation is recorded in audio or video without your explicit prior consent, and that consent is noted in your file. What is retained from the session is what the physician writes into the medical record.

We suggest you take the consultation somewhere quiet and private, since anyone sharing the room will hear what is said, and that is outside our control. If you would like someone with you, an interpreter or one of your children, tell the physician at the start of the session so it can be noted in the record.

The clinic team is bound by professional confidentiality, and no one attends the session other than the physician and, where needed, the care coordinator.

6. Who sees your information

Your information is seen by the treating physician, the care coordinator and the clinical supervisor, only to the extent your care requires. It is also handled by the technology providers we contract to run the platform, the video consultation, the payment gateway, invoicing and the messaging channel. Each is under a contractual duty of confidentiality and may not use your data for any purpose beyond the one contracted.

We may share what is necessary with a provider we refer you to, such as a laboratory, hospital or specialist, and that happens only with your knowledge and consent. We also disclose what the competent authorities require by law, such as the Ministry of Health, the Zakat, Tax and Customs Authority, or under a court order.

We do not sell, rent or share your data with advertisers or data brokers, under any circumstances.

7. Where your data is kept, and for how long

Your health data is held on servers inside the Kingdom of Saudi Arabia, in compliance with Ministry of Health requirements on storing telemedicine data within the Kingdom.

The medical record is retained for the period set by the health regulations [statutory retention period], and financial records for the period required under the VAT law. Marketing data is kept until you withdraw your consent.

8. How we protect your information

We apply technical and organizational measures including encryption in transit, access restricted so that only those whose role requires it can open a file, logging of access, and periodic review of permissions.

No electronic method can guarantee absolute security. If a breach materially affecting your data occurs, we undertake to notify you and the competent authority.

9. Your rights

The Personal Data Protection Law gives you the right to know how your data is used, to request a copy of it, to have anything incorrect or incomplete corrected, to request its destruction once it is no longer needed, and to withdraw consent where your consent was the basis for processing.

We respond to your request within thirty days of receiving it. Note that the right to destruction does not extend to medical or financial records we are required by law to retain. If our response does not satisfy you, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

10. The website and our messaging channels

Our website uses essential cookies to operate the page and remember your preferences, and analytics cookies to measure usage. You can control these from your browser settings.

We contact you through the clinic’s official WhatsApp channel to confirm appointments and send payment links and invoices. Please do not send medical details through public comments or direct messages on social media, as these are not secure channels. The clinic’s unified number is the approved route.

11. Changes to this policy

We may update this policy from time to time, and an update takes effect from the date it is published on the website. We suggest you review this page when you make a new booking.