Privacy Policy

RehabX is a digital platform that connects referring physicians, physiotherapy clinics, physiotherapists, and patients in the Kingdom of Saudi Arabia. It is operated by [legal entity name], with commercial registration [CR number], located at [registered address].

In this policy, "RehabX", "we", and "us" refer to that company. Questions about your personal data can be sent to [privacy contact email].

This policy explains how we collect, use, share, and protect personal data when you use the RehabX website and its portals for patients, physicians, physiotherapists, clinic staff, and RehabX administrators.

We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations, as well as the health information rules applicable to healthcare providers in the Kingdom.

If you are a patient: your name, mobile number, date of birth, sex, preferred language, and your email address if you provide it. From your referring physician: your condition, working diagnosis and ICD-10 code, the reason for referral, precautions, and any red flags. From you: your responses to safety screening and intake questions, questionnaires, pain and function scores, your exercise program, the sessions you log, your appointments and attendance, and messages you send to the AI assistant.

If someone else's mobile number is used for you (for example, a parent's), we record whose phone it is and, if provided, that person's name. Each person sharing a number has their own separate record.

Optional insurance details: your insurer, member or card number, policy or class, and card expiry, if you or your clinic add them.

If you are a healthcare professional or clinic staff member: your name, email, mobile number, role, clinic, professional license number, and for physiotherapists, details used to match patients (such as gender and conditions treated).

Technical information: sign-in records, the IP address used (for security and to limit repeated requests), and an audit log of actions taken on the platform.

To manage the referral pathway: invite you to complete the intake, check safety before booking, match you with a suitable physiotherapist, and book your first visit.

To support your care: share your intake, progress, and questionnaire results with your care team, and provide your exercise program.

To contact you: send sign-in codes, invitations, appointment confirmations and reminders, and questionnaire links via SMS or WhatsApp, and account emails to staff.

To operate the service: billing clinics for platform use, maintaining service security, preventing misuse, and fulfilling our legal obligations.

To improve the service using statistics that do not identify you.

We do not sell personal data, and we do not use it for advertising.

We process your data to provide the health services you or your physician requested, with your consent where required (your physician confirms that you agreed to be contacted by RehabX), and to meet legal obligations. You may withdraw your consent at any time; this does not affect processing that occurred before you withdrew it. [Legal review: confirm the legal bases under the PDPL for each purpose.]

Your physiotherapist and clinic see the information they need to treat you. Front desk staff see your contact details and appointments, not your clinical details.

Your referring physician sees your care status and progress.

RehabX administrators can access data to support the service, review referrals, and ensure platform safety.

We do not share your information with your employer or anyone else without a legal basis.

We use trusted providers who process data on our behalf under contract: database and hosting (Supabase, [hosting region]); SMS (4jawaly, Saudi Arabia); WhatsApp messages (Twilio, where enabled); email (Resend); and artificial intelligence (OpenAI).

AI is used for the patient assistant and to draft exercise programs for physiotherapists to review. Before anything is sent to the AI service, names, phone numbers, and ID numbers are removed; for program drafts, only an age band and sex are sent. These AI services process data outside the Kingdom.

Some of our providers process data outside Saudi Arabia. Where this occurs, we apply the safeguards required by the PDPL and its regulations on transferring personal data outside the Kingdom. [Legal review: list each transfer, its legal basis, and safeguards.]

Data is encrypted in transit, access is limited by role so each person sees only what their role requires, patients sign in with one-time codes, and actions are recorded in an audit log. We regularly review access and security.

We retain health records for as long as required by the rules applicable to healthcare providers in the Kingdom, and other data only as long as needed for the purposes outlined above. One-time sign-in codes are deleted within a day. [Legal review: confirm retention periods for each type of record.]

You have the right to be informed about how your data is used, to access a copy of it, to request corrections or completion, and to request deletion when it is no longer needed (subject to legal retention requirements). You may also withdraw your consent.

To exercise these rights, contact your clinic or write to [privacy contact email]. You may also file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

Information about a child is provided by their parent or legal guardian, who acts on the child's behalf in RehabX.

We may update this policy. The date at the top indicates when it was last changed, and we will inform you of significant changes through the platform.

[Legal entity name], [registered address]. Email: [privacy contact email]. Phone: [contact phone].