Draft — pending review by Bnoon's compliance team.
This page has not yet been reviewed or approved by Bnoon's legal and compliance team. The content below is a working draft and should not be treated as a final or legally binding statement. It will be updated before the site goes live.
Important: This draft is provided for general information only. It is not legal advice, does not create a contract, and does not waive or limit any rights or obligations under applicable law. The final privacy policy will replace this notice after formal review.
Privacy Policy
Last updated: August 2026 · Effective date: pending compliance review
Bnoon Health ("Bnoon", "we", "our") is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, and your rights under the Saudi Personal Data Protection Law (PDPL) and applicable international privacy frameworks. If you have any questions, contact us at info@bnoon.sa.
1. What data we collect
We collect two broad categories of personal data: general contact and administrative information, and sensitive health-related information. We collect health-related data only where it is directly necessary to provide fertility and women's health services and with your explicit consent.
General contact and administrative data
This includes your name, phone number, email address, preferred language, and communication preferences — collected when you submit a booking request, referral form, or contact enquiry on this website.
It may also include basic appointment and scheduling information such as your preferred clinic location, appointment dates, and the treatment you are enquiring about.
Sensitive health-related data
If you proceed to register as a patient at a Bnoon clinic (online or in person), we collect medical history, fertility-related diagnostic information, laboratory and imaging results, treatment plans and outcomes, and any other clinical data needed to provide your care. This is explicitly categorised as sensitive personal data under the PDPL and is handled with heightened safeguards.
Through the website self-assessment, we may collect limited fertility-related answers when you choose to submit them with contact details and accept the assessment privacy statement. These answers are not a clinical record. Full medical history and other clinical data are gathered directly by your clinical care team within the clinic's own secure electronic medical records system.
Usage and technical data
When you submit an appointment request or physician referral, or complete the self-assessment, we store the enquiry’s first- and last-touch source details with its reference number: UTM values, referring website, landing and submission pages, dates, page context, language, device type, and your cookie-consent state. A contactless self-assessment stores only a non-sensitive completion marker and this source context; answers and contact details are stored only when they are submitted with the assessment privacy statement accepted. We use this operational information to understand how an enquiry reached Bnoon and reconcile it with booking and finance records. Advertising click identifiers (such as Google, Meta, TikTok, and Microsoft click IDs) are stored only if you have accepted advertising cookies; otherwise the enquiry is marked as consent-limited. Source and reconciliation details are automatically removed 12 months after the submission date. If you have consented to analytics cookies, we also collect aggregated, anonymised data about how visitors use this website.
First-party page-view measurement
We also count website page views for our own aggregate traffic measurement. For each view we keep the page path, site language, the hour of the visit, referring host where available, a coarse device type and an approximate country derived from the network request. We do not store an IP address, set an identifying cookie, create an individual visitor profile, or link page views to each other or to an enquiry. This non-identifying count operates regardless of cookie-consent choices; Google Analytics remains separate and runs only when analytics cookies are accepted. These aggregate page-view records are deleted after 12 months.
2. Why we collect it
We collect and process personal data only for specific, disclosed purposes. The table below summarises the main purposes and the legal basis for each:
| Purpose | Data used | Legal basis |
|---|---|---|
| Respond to enquiries and booking requests | Name, phone, email, preferred clinic | Legitimate interest / Contract performance |
| Provide fertility and women's health clinical care | Full medical history, diagnostic and clinical data | Explicit consent; provision of medical services |
| Send appointment reminders and follow-up communications | Name, phone/email, appointment details | Contract performance; legitimate interest |
| Understand and reconcile how a website enquiry reached Bnoon | Source details stored with the enquiry reference number; advertising click IDs only when advertising cookies are accepted | Legitimate interest; consent for advertising click IDs |
| Improve the website and understand how it is used | Anonymised usage data (analytics cookies) | Consent |
| Comply with legal obligations | As required by Saudi law and healthcare regulations | Legal obligation |
| Marketing and personalised advertising | Anonymised browsing data (if marketing cookies accepted) | Consent |
We will never use your health-related data for marketing purposes. We will never sell your personal data to third parties.
3. How long we keep it
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by Saudi healthcare regulations and applicable law.
| Data type | Retention period |
|---|---|
| Website enquiry and contact form data | 12 months from last interaction, unless a patient relationship is established |
| Website enquiry source and reconciliation data | Removed automatically 12 months after the submission date |
| First-party aggregate page-view records | Automatically deleted after 12 months |
| Patient clinical records | Minimum 10 years from last clinical encounter, as required by Saudi Ministry of Health regulations |
| Analytics and cookie data | As configured in Google Analytics (typically 14 months for aggregated data) |
| Financial and billing records | As required by Saudi tax and accounting law (typically 5–10 years) |
At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an individual.
4. Who can access your data
Authorised Bnoon staff
Access to your personal data within Bnoon is limited on a strict need-to-know basis. Clinical data is accessible only to the clinicians and clinical coordinators directly involved in your care. Administrative data (contact details, appointment history) is accessible to reception and patient experience staff within the relevant clinic.
Third-party processors
We use a limited number of trusted third-party service providers who process data on our behalf and under our instruction. They are not permitted to use your data for their own purposes. Current third-party processors relevant to this website include:
- Google Tag Manager / Google Analytics — anonymised website usage analytics (only if analytics cookies are accepted)
- WhatsApp Business (Meta) — used as a communication channel for enquiries initiated by patients. Messages sent via WhatsApp are subject to Meta's privacy policy
- Electronic Medical Records (EMR) provider — the platform used to store clinical patient records within our clinics (provider name to be confirmed)
- Cloud hosting provider — the infrastructure on which this website is hosted (provider name to be confirmed)
We do not share your personal data with any other third parties without your explicit consent, unless required to do so by law.
5. Data transfers outside Saudi Arabia
Some of our third-party service providers are based outside the Kingdom of Saudi Arabia, which means your data may be processed in another country. Where this occurs, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required under the PDPL.
Specifically, Google's data processing infrastructure (for Google Analytics and GTM) may process anonymised analytics data on servers outside Saudi Arabia. This data is aggregated, does not contain personally identifiable information, and is processed in accordance with Google's ISO 27001-certified security framework.
We do not transfer sensitive health-related (clinical) data outside Saudi Arabia except where clinically required and with your explicit prior consent.
6. Your rights under the Saudi PDPL
Under the Saudi Personal Data Protection Law (PDPL) — Royal Decree M/19 of 1443H — you have the following rights with respect to your personal data:
Right of access
You can request a copy of the personal data we hold about you.
Right to correction
You can request that inaccurate or incomplete data is corrected.
Right to deletion
You can request deletion of your personal data, subject to legal retention requirements (e.g. clinical records mandated by regulation).
Right to withdraw consent
Where processing is based on your consent, you can withdraw it at any time — without affecting the lawfulness of processing before withdrawal.
Right to object to processing
You can object to certain types of processing, including direct marketing.
Right to data portability
In some circumstances, you can request a structured, machine-readable copy of your data.
To exercise any of these rights, please contact our patient data team at info@bnoon.sa. We will respond within 30 days of receiving your request. If you are unsatisfied with our response, you have the right to complain to the Saudi Authority for Data and Artificial Intelligence (SDAIA).
Questions about this policy?
If you have any questions about how we handle your personal data, or to exercise any of your rights, please contact us: