Privacy Policy

Last updated: 19 October 2026 · Effective from: 19 October 2026

1. Introduction

MedFix respects the privacy of its customers and users and is committed to protecting the personal data processed through the platform in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended, and its implementing regulations, and all other laws and regulations in force in the Kingdom of Saudi Arabia. This policy explains what data is collected, why it is used, and how it is processed and protected. MedFix is the controller of account data, technical data and website visitor data; data that a facility enters into the system is processed by MedFix as a processor on the facility's behalf and under its instructions, pursuant to the Data Processing Agreement.

2. Data we collect

MedFix may collect and process the following data:

Account data

• Full name
• Email
• Phone number
• Job title
• Employer

Facility data

• Facility name
• Branch data
• Department data
• Administrator and user information

Equipment and asset data

• Medical equipment data
• Maintenance data
• Contract and warranty data
• Supplier data
• Spare parts data

Technical data

• IP address
• Browser information
• Sign-in logs
• Activity logs within the system
• Cookies

3. Purposes of processing

Data is used for the following purposes:

• Creating and managing accounts
• Operating MedFix services
• Managing maintenance work
• Producing reports and statistics
• Providing technical support
• Improving performance and user experience
• Protecting system security
• Complying with legal and regulatory requirements

4. Patient health data

The MedFix system is designed to manage the maintenance of medical equipment and engineering assets. It is not intended to manage or store medical records or patients' health information. The Customer is responsible for not entering any health data or patient-identifying information unless legally permitted and under separate agreements between the parties.

5. Legal basis for processing

Data is processed on the basis of: performing the contractual relationship with the Customer, operating the requested services, complying with legal obligations, and legitimate operational interests relating to the security and operation of the platform.

6. Data sharing

MedFix does not sell, rent or trade customer or user data. Data may be shared to the minimum extent necessary with: hosting service providers, email service providers, payment service providers, and regulatory or judicial authorities where there is a legal obligation.

7. Data transfer outside the Kingdom

Platform data is hosted with cloud hosting providers. If providing the service requires transferring personal data to, or disclosing it to, a party outside the Kingdom of Saudi Arabia, this is done only in accordance with the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, in a way that ensures a level of protection no lower than that required by law, and limited to the minimum data necessary. Customers may request information about where their data is hosted via the email address in the Contact section.

8. Data protection

MedFix applies reasonable technical and administrative controls to protect data against unauthorized access, unlawful modification, unauthorized disclosure, and loss or damage. These measures include encryption, permission management, audit logs and appropriate security procedures. If a breach of or unlawful access to personal data occurs, MedFix will take the necessary steps to contain it and limit its impact, and will notify the Saudi Data and AI Authority (SDAIA) and the affected data subjects or customer within the timeframes and procedures required by law.

9. Data retention

MedFix retains data for the duration of the active subscription. When the service is cancelled or the subscription ends, the platform retains the data for no more than ninety (90) days for recovery, data export or technical requests. After that period the data is securely deleted or destroyed, unless a law requires it to be kept longer. Backups are deleted at the end of their own retention cycle under the Backup Policy, and technical and access logs are kept for as long as needed for security purposes or as required by law.

10. Data subject rights

Under the Personal Data Protection Law, data subjects have the right to: be informed of how their data is collected, the purpose of processing and its legal basis; access their data and obtain a copy of it in a clear format; request correction, completion or updating of their data; request destruction of their data once it is no longer needed; and withdraw consent where consent is the basis for processing. For data that a facility enters into the system, requests should be directed to the facility as the controller, and MedFix will cooperate with it in fulfilling them. MedFix may ask for proof of the requester's identity and will respond to requests within the period required by law. Data subjects may also lodge a complaint with the Saudi Data and AI Authority (SDAIA).

11. Aggregated and anonymized data

MedFix may use aggregated or anonymized statistical data for: performance analysis, service development, preparing general indicators, and improving the user experience — provided that the identity of the customer, user or facility cannot be determined from it.

12. Cookies

MedFix uses cookies in accordance with its Cookie Policy to improve the user experience and strengthen system security.

13. Changes to this policy

MedFix may amend this policy from time to time. The updated version will be published in the platform and on the website with a revised effective date, and customers will be notified of material changes by email or in the system before they take effect.

14. Contact

For questions or requests about privacy, data processing or exercising data subject rights, contact MedFix by email at: info@medfix.pro