Privacy and Personal Data Protection Policy

Scope

This policy explains how personal data is handled when you use Nera’s website, appointment request and management services, contact forms, and the center’s related digital channels.

What data may we collect?

Depending on the service you use, data you provide may include:

• Name.
• Mobile number.
• Email address.
• Specialty or requested service.
• Preferred appointment date and time window.
• Appointment number or code.
• Visit reason or information you choose to include in a booking request.
• Content of inquiries and messages you send to the center.
• Insurance- or service-related information when needed.
• Technical information required for site security and operation, according to technologies actually in use, which may include an abuse-protection challenge via Cloudflare Turnstile without invasive browser fingerprinting.

Health-related data

Information you voluntarily provide in “visit reason” or free-text messages may include health-related data. We treat such data as sensitive and use it only for the purpose tied to the service and care, or as otherwise permitted by law.

Why we use your data

We may use data to:

• Receive and manage appointment requests.
• Contact you about the appointment or service.
• Handle rescheduling, cancellation, and follow-up.
• Provide medical and administrative services related to your request.
• Verify insurance coverage when needed.
• Handle inquiries and complaints.
• Protect the website and systems from unlawful use.
• Meet legal and regulatory obligations.
• Improve service quality and beneficiary experience, when permitted by law.

Legal basis for processing

We process personal data on the legal basis appropriate to each purpose—such as your consent, performing a service you requested, complying with a legal obligation, protecting vital or health interests, or any other basis permitted under the Personal Data Protection Law.

Data sharing

We do not sell your personal data.

The minimum necessary data may be shared, when needed and as permitted by law, with parties such as:

• Technology providers that support system operation.
• Insurance companies or networks related to the service.
• Payment service providers when you use their services.
• Health, supervisory, or government authorities when disclosure is legally required.
• Other parties necessary to deliver the service, and only to the extent required.

Data protection

We apply appropriate technical, organizational, and administrative measures to protect personal data against unauthorized access, loss, alteration, or unlawful disclosure, taking into account the nature and sensitivity of the data.

Data retention

We retain data for as long as needed to fulfill the purposes for which it was collected and in line with applicable legal and regulatory retention requirements, after which it is handled under approved destruction or anonymization procedures.

Your rights

Under the Personal Data Protection Law, and subject to applicable cases and exceptions, you may have the right to:

• Know how your data is processed.
• Access your personal data.
• Request it in a clear, readable form.
• Request correction or completion of inaccurate data.
• Request destruction of data when legal conditions apply.
• Withdraw consent when consent is the basis for processing and no other legal basis requires continued processing.
• Lodge a complaint or objection regarding the processing of your data.

Exercising your rights or contacting us

Nera Specialty Medical Center & Day Surgery Imam Abdullah Ibn Saud Ibn Abdulaziz Rd – Al Shuhada – Riyadh Phone: +966564220035 Email: contact@neramed.com

+966564220035contact@neramed.com

Policy updates

We may update this policy when our services, systems, or regulatory requirements change. The last-updated date will appear at the top of this page.