Privacy Policy

Last updated: 21 October 2026

This policy explains how Raja collects, uses and protects your personal and health data, in line with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. By using the platform you acknowledge that you have read it. If the Arabic and English versions differ, the Arabic version prevails.

Who we are

The Raja platform (raja.health and its apps) is operated by شركة رجا التخصصية (Raja), Commercial Registration (unified No.) 7055060953, VAT No. 314984069100003, the controller of your personal data. For anything about your data, contact support@raja.health.

What we collect

Account and identity data: name, email, mobile number, date of birth, gender, nationality and other identifying details you provide.
Health data: symptoms, pre-consultation forms, medical history, clinical notes, diagnoses, prescriptions and files you upload.
Consultation data: the spoken conversation during a consultation, transcribed for documentation, and an audio/video recording if your doctor turns recording on. Recordings are stored with the visit record.
Payment data: amount, status and reference. Card details are entered directly with the payment gateway; we do not store your card number.
Your conversations with the in-portal AI assistant.
Technical data: sign-in logs, IP address, device and browser type, used for security and troubleshooting.

How we use it

To provide remote medical consultations and to book and manage appointments.
To let your doctor see your health record, document the consultation and issue prescriptions.
To process payments and refunds and to issue invoices.
To verify your identity with one-time codes and protect your account.
To contact you about your appointments, your account and support requests.
To meet legal obligations, including keeping medical records as Ministry of Health rules require.
To improve the quality and safety of the service. We do not sell your data and we never use your health data for marketing.

Legal basis

We process your data on the basis of the explicit consent you give at sign-up, to deliver the service you asked for, to meet legal obligations, and where necessary to protect your vital interests. You may withdraw consent at any time. Withdrawal does not affect processing that happened before it, may stop us from providing the service, and does not end our duty to keep your medical record for the period the law requires.

Artificial intelligence

We use AI tools to transcribe consultations, to draft clinical (SOAP) notes, and to run the in-portal assistant. Everything AI produces during a consultation is a draft that your doctor reviews, edits and approves; medical decisions remain the doctor's alone. The assistant does not diagnose or prescribe.

These tools run through technology providers under contract with us, bound by confidentiality and data-protection obligations.

Transfers outside Saudi Arabia

Some data may be processed outside the Kingdom by our service providers. Any such transfer is made under the PDPL and its regulation on transferring personal data outside the Kingdom, limited to what the service needs and with appropriate safeguards.

How long we keep it

Medical records (consultation notes, prescriptions, recordings): for the period Ministry of Health rules require. They are not deleted earlier, even if you close your account.
Non-medical account data: for the life of the account, then deleted or anonymised unless the law requires us to keep it.

Your rights

To be informed how your data is processed (this policy is part of that).
To access your data and receive a copy in a readable format.
To correct, complete or update your data.
To ask for your data to be destroyed once it is no longer needed, subject to the legal retention period for medical records.
To withdraw your consent.

To exercise any of these rights, email support@raja.health; we will respond within the period the law sets. You may also complain to the Saudi Data & AI Authority (SDAIA).

Security

We encrypt connections to the platform and consultation traffic, restrict access to health data by role, log access, and mask personal data in technical monitoring logs. No system is perfectly secure; if a breach affects your data, we will notify you and the competent authorities as the law requires.

Cookies

We use only essential cookies, for sign-in, keeping your session and remembering your language. We use no analytics or advertising tools that track you.

Minors

The platform is for people aged 18 or over. Care for anyone younger is arranged by their guardian, through the guardian's account and with their consent.

Changes

We may update this policy. We will publish the new version here with its date and tell you about material changes before they take effect.