Privacy and Security Policy
How we collect, use, and protect your personal and health information
1. Scope of the Policy
This policy applies to all personal data collected by Selfwell+ in connection with the delivery of test kits, coordination of sample collection, processing of samples through approved laboratories, delivery of results, and the operation of our website, mobile application, and customer service channels. By using our website, mobile application, or any Selfwell+ service, you acknowledge that you have read and understood this Privacy and Security Policy and consent to the collection, use, and disclosure of your information as described herein, without prejudice to any rights afforded to you under applicable laws and regulations in the Kingdom of Saudi Arabia.
2. Information We Collect
We collect the following categories of information: • Identity and Contact Information: Full name, national ID or Iqama number, date of birth, gender, phone number, email address, and delivery/billing address • Order and Payment Information: Order history, test selection, and payment confirmation details (card credentials are processed directly by our licensed payment providers; we do not store full card numbers) • Health and Biological Data: Test type, sample type, relevant medical or clinical history you provide, laboratory results, and related documentation • Technical and Usage Data: Device identifiers, IP address, browser type, operating system, app usage patterns, and cookie data
3. How We Use Your Information
We use the information we collect to: • Process and fulfill orders, including preparing, delivering, and collecting test kits and samples • Coordinate with approved laboratories to perform testing and deliver results • Communicate with you regarding your order, appointment scheduling, and results • Provide customer support and respond to inquiries, complaints, or return and refund requests • Comply with applicable legal, regulatory, and public health obligations • Improve our services, website, and mobile application • Send service-related and, where you have consented, marketing communications
4. Legal Basis for Processing
We process your personal data on one or more of the following legal bases: your explicit consent, the necessity of processing to perform our contract with you, compliance with a legal or regulatory obligation, protection of vital interests where relevant to your health and safety, and our legitimate interest in operating and improving our services, provided this does not override your fundamental rights.
5. Health and Sensitive Data
Health-related and biological data is treated as sensitive data and receives the highest level of protection under this policy and applicable law. Access to health and sample-related data is restricted to authorized personnel, approved laboratories, and medical professionals directly involved in providing the service. This data is used solely for the purpose of delivering the test, generating results, and any related medical follow-up, and is not used for unrelated marketing purposes or sold to third parties. Where required, we obtain your explicit consent before collecting or processing sensitive data.
6. How We Share Your Information
We do not sell your personal data. We may share your information only in these circumstances: • Approved laboratories and medical professionals involved in processing your sample and issuing results • Delivery and logistics partners engaged to deliver test kits and collect samples • Licensed payment service providers to process transactions • Government authorities and regulators, where required by applicable laws and regulations in the Kingdom of Saudi Arabia • Professional advisors, such as auditors or legal counsel, bound by confidentiality obligations
7. International Data Transfers
Your data is primarily stored and processed within the Kingdom of Saudi Arabia. Where any transfer of personal data outside the Kingdom is necessary, Selfwell+ ensures such transfers comply with the requirements of the Personal Data Protection Law, including verifying that an adequate level of protection is in place at the receiving destination.
8. Data Security Measures
We implement administrative, technical, and physical safeguards designed to protect your personal and health data: • Encryption of data in transit and at rest • Role-based access controls limiting data access to authorized personnel only • Secure hosting infrastructure and regular security assessments • Staff training on data protection and confidentiality obligations • Incident response procedures to detect, contain, and address potential security events While we take reasonable measures to protect your data, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
9. Data Retention
We retain personal and health data only for as long as necessary to fulfill the purposes described in this policy, including any medical record-keeping, legal, regulatory, or accounting requirements. Once data is no longer required, it is securely deleted or anonymized in accordance with applicable laws and regulations.
10. Your Rights
Subject to applicable law, you have the right to: • Access the personal data we hold about you • Request correction of inaccurate or incomplete data • Request deletion of your data, where retention is not otherwise required by law • Withdraw consent to processing at any time, where processing is based on consent • Object to or request restriction of certain processing activities • Request a copy of your data in a portable format, where technically feasible • Lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) To exercise any of these rights, contact us using the details below.
11. Cookies and Tracking Technologies
Our website and mobile application use cookies and similar tracking technologies to enable core functionality, remember your preferences, and analyze usage to improve our services. You can control or disable cookies through your browser or device settings; note that disabling certain cookies may affect the functionality of our website or application.
12. Account Security
If you create an account with us, you are responsible for maintaining the confidentiality of your login credentials and for all activity that occurs under your account. Please notify us immediately if you suspect any unauthorized access to or use of your account.
13. Children's Privacy
Our services are not directed at individuals under the age of 18. Where a test is ordered for a minor, this must be done by a parent or legal guardian who provides consent on the minor's behalf and assumes responsibility for the accuracy of the information provided.
14. Third-Party Links and Services
Our website or application may contain links to third-party websites or services not operated by Selfwell+. We are not responsible for the privacy practices or content of any third-party sites, and we encourage you to review their privacy policies separately.
15. Data Breach Notification
In the event of a data breach that poses a risk to your rights or personal data, Selfwell+ will notify affected customers and the relevant regulatory authorities as required under applicable laws and regulations, and will take prompt action to contain and remediate the incident.
16. Changes to This Policy
Selfwell+ may update this Privacy and Security Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be posted on our website and application with a revised effective date. Material changes will be communicated to you through appropriate channels where required.
Privacy & Security Questions?
For questions, requests, or complaints regarding this Privacy and Security Policy or how your data is handled, contact our Customer Service team:
Unified Number: 8005000009
You may also lodge a complaint directly with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data protection rights under the Personal Data Protection Law have not been respected.
