Personal Data
Protection Law (PDPL).

Data Controller

Healthcare providers or organizations using the platform are responsible for determining the purposes and means of processing patient data.

Personal data is processed only for legitimate healthcare and operational purposes, including:

• EMS documentation and reporting
• operational workflow coordination
• platform administration and security
• compliance with healthcare regulations

Processing of personal data is based on:

• contractual necessity to provide the services
• healthcare service requirements
• compliance with legal and regulatory obligations

Personal data may be shared with limited service providers required for the operation of the platform, including:

• cloud hosting providers
• system monitoring services
• AI report structuring services (without patient identifiers)

AI Processing Safeguards:

• no patient identifiers are transmitted
• data is minimized prior to processing
• no retention or reuse for model training
• processing is limited to request-response interactions

In accordance with the Saudi Personal Data Protection Law, individuals may have rights including

• access to their personal data
• correction of inaccurate data
• deletion of personal data where legally permissible
• knowledge of how their data is processed

Upon termination of services:

• data may be retained for up to 30 days for export
• data shall be deleted or anonymized within 90 days

TAQRIR implements appropriate technical and organizational safeguards including

• encryption in transit
• encryption at rest
• role-based access control
• monitoring and logging
• Vulnerability management
• Incident response procedures

Taqrir Alraqamiya Company

Email: privacy@taqrir.sa