Privacy policy
Data and purposes
We process email for authentication, profile and contact details you add, photos, optional health information, consent records, and security events. These support profiles, sharing controls, and service security.
Sharing and sensitive data
Fields are private by default. Anyone who obtains a link can view and potentially copy public fields. Public health data requires explicit consent and its fields are encrypted at rest. You may disable links and revoke consent at any time; this cannot recover copies already made by visitors.
Processors and data locations
The application uses Cloudflare Workers, D1, R2, Resend for email codes, and locally hosted Tajawal. Processing agreements, storage locations, and cross-border transfers must be assessed under Saudi personal data protection requirements before launch.
Retention and your rights
Sign-in codes expire after five minutes and sessions after thirty days. Expiry prevents use but does not immediately delete records. The retention schedule and processes for access, correction, deletion, and objections must be defined and approved. Deactivation is not deletion.
Cookies
We use a secure session cookie and a language preference cookie. This version includes no advertising or marketing analytics.
Required before approval
- Operator identity, address, contact channel, and data protection contact.
- Lawful bases, dependent data handling, and sensitive-data impact assessment.
- Retention and deletion policy, rights procedures, and incident response.
- Processor and international transfer review, and final legal approval.