Privacy policy

1.Who we are

WEJHA CLINIC is a clinic directory and booking platform. We are the controller of the personal data collected through the platform. The clinic you book with is a separate controller of the medical record it creates about you, under its own policy.

2.What we collect

If you are a patient, we collect:

• Your email address for sign-in, your name, mobile number and city if you add them, and your profile picture if you upload one.
• Your approximate or precise location if you allow access, to find nearby clinics and calculate distances. Location permission is optional; you can browse and book without it.
• Your bookings: the clinic, branch, doctor, service, time, status, the price shown, and the cancellation reason if there was one.
• Your reviews: the stars, the text, and the clinic’s reply.
• Your notification preferences, and a device identifier if you enable push notifications.
• Your previous mobile number and when it changed, if you change it — so your booking history stays attached to you.

If you are a clinic, we also collect:

• Your business details: name, description, specialty, city, branches, working hours and contact channels.
• Your licence number and the verification documents you upload — stored privately, not reachable by a public link.
• Your team’s accounts and their roles, and your subscription record, invoices and the payment receipts you upload.

We automatically collect limited technical data as you use the platform: IP address, browser or device type, request timestamps and server error logs. It is used to run the service, fix faults and protect it from abuse. Third-party crash reporting is not enabled in Android version 1.0.1.

We never collect your card details, because the platform takes no payment from patients. We do not collect your diagnosis, test results or medical record — those stay with the clinic. What we know is that you booked a particular service at a particular time.

3.Why we use it, and on what basis

• To deliver what you asked for: create your account, pass your booking to the clinic, and tell you what happened to it. Basis: performance of our agreement with you.
• To verify clinics before listing them, and to keep reviews tied to real appointments. Basis: our legitimate interest in protecting patients.
• To protect the platform from fraud and abuse and to investigate reports. Basis: our legitimate interest.
• To send offer notifications and marketing messages. Basis: your consent, which you can withdraw from your account settings at any time.
• To invoice clinics and keep accounting records. Basis: a legal obligation.

Notifications about your own booking are not marketing and cannot be switched off while you have an active booking — they are part of the service itself.

4.Who we share it with

With the clinic you book with — that is what a booking is. The clinic sees your name, your mobile number and the details of the appointment you asked for. It does not see your bookings with any other clinic.

And with service providers who act for us and on our instructions only:

• Our email provider, to send your sign-in code, booking notifications, account messages and invoices.
• Our media storage provider, for profile pictures, clinic images and clinic documents.
• The hosting and database provider the platform runs on.
• Apple’s and Google’s notification services, to deliver notifications to your phone if you turn them on: they receive the notification text and your device’s notification token.

We may also disclose data to a competent government or judicial authority where the law requires it, or to protect someone’s rights or safety.

We do not sell or rent your personal data. And we place no advertising trackers or cross-site analytics on this platform.

5.Cookies

We use three cookies, all first-party, and all necessary for the site to work:

• wejha_access — keeps you signed in as you browse. Short-lived.
• wejha_refresh — renews your session so you are not asked to sign in again and again.
• wejha_locale — remembers whether you chose Arabic or English.

There is no advertising or analytics cookie, which is why you are not shown a cookie consent banner. Clearing these from your browser signs you out and resets the language to the default.

6.Transfers outside the Kingdom

Some of the providers above process data on servers outside the Kingdom. Where that happens we limit it to what running the service requires, and we contract with them to protect the data and not use it for any purpose of their own, consistent with the transfer provisions of the Personal Data Protection Law and its implementing regulations.

7.How long we keep it

• Your account details: for as long as your account exists.
• Your booking history: kept so that you and the clinic can refer back to it and settle any dispute about an appointment.
• Reviews: they stay published while the clinic is listed, because removing one changes an average that other readers relied on.
• Clinic invoices and accounting records: for the period Saudi tax and accounting rules require.
• Technical logs: for a short period, enough to diagnose problems and investigate abuse.

When you close your account we delete or de-identify what we are not required to keep. A review you wrote may remain published without your name.

8.Your rights

The Personal Data Protection Law gives you the right to:

• Know how your data is collected and used.
• Access your data and obtain a copy of it.
• Correct anything inaccurate or incomplete.
• Ask for it to be destroyed where there is no longer a lawful need to keep it.
• Withdraw consent for anything based on consent, such as marketing messages.

You can change your name, mobile number, city and notification preferences directly in your account settings. For anything else, contact us using the details below and we will respond within the period the law allows.

You can delete your account at any time: in the app under Account → Delete account, or by following the steps on our account deletion page at wejhaclinic.com/delete-account.

If our answer does not satisfy you, you have the right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the law.

9.How we protect it

• Passwords are stored hashed. Nobody here can read one.
• Traffic to and from the platform is encrypted in transit.
• Clinics' verification documents are stored privately and opened through temporary signed links, never a public URL.
• Access inside a clinic is limited by role: a receptionist sees the appointment queue, a content editor sees the public profile, and neither sees the clinic’s billing.
• Changing or removing a staff member’s role takes effect on their live session immediately, rather than waiting for it to expire.

No system is perfectly secure. If a breach affects your personal data, we will notify you and report it to the competent authority as the law requires.

10.Children’s data

The platform is for people aged 18 and over. A guardian may book for a child from their own account, and in that case the guardian is responsible for the child’s details they give us. If we learn that a child has created an account unsupervised, we close it and delete the data.

11.Changes to this policy

We may update this policy when what we collect, who we share it with, or what the law requires changes. The date at the top of this page shows the current version, and we notify account holders of material changes before they take effect.