Afiyah · Policy notice · 29 October 2026
Health information. Protected by purpose.
Health records, wellbeing information, family permissions and care handovers need clearer safeguards than an ordinary website visit.
Finding your country preference…
Scope and responsible roles
The private service may process records you provide, permitted device information, goals, wellbeing entries, care requests and relevant derived explanations within the feature you use. The applicable service notice identifies the controller or processor role and any independent healthcare provider. A membership alone does not create a clinician-patient relationship or authority over another person’s record.
Residency and separate processing
Afiyah’s commitment is GCC hosting for core app health records and associated app personal data. The service notice must name the approved country, storage and backup scope, permitted support access and any separate processing before that use. Saudi, UAE and other local health-transfer restrictions still apply. Public website pages are globally delivered and website enquiries are processed in the United States; do not submit medical records to public forms or chat.
Accuracy, permissions and care handovers
Keep the original source, person, date, unit and laboratory reference range with an explanation. Missing or conflicting data requires clarification. Family, guardian and caregiver access is person-specific and limited by authority, age and purpose. Before a consequential share, show the recipient, data and purpose and obtain the required approval. Prepared, submitted, acknowledged and completed are different statuses.
Secondary use and sensitive inferences
Health data must not be sold for advertising, shared with advertising pixels or repurposed for unrelated model training through general terms. A distinct optional training or research use requires its own lawful basis, transparent scope and applicable safeguards. Derived scores and predictions remain protected when linked to a person. Employers receive only their permitted reporting scope, not unrestricted clinical files or private conversations.
UAE health-data restrictions
For health data within Federal Law No. 2 of 2019 concerning UAE health services, Article 13 restricts storage, processing, generation and transfer outside the UAE except through an applicable legally permitted case or authorization. Another GCC country is outside the UAE for this purpose. A general consent or a GCC hosting commitment alone does not establish that permission. The approved service must document the UAE health-sector rules, storage and support locations, retention and any applicable exception before the affected processing.
Saudi health-data safeguards
Saudi PDPL Article 23 and Implementing Regulation Article 26 require additional health-data controls. Access and processing are limited to the minimum necessary for the lawful health service or insurance purpose. Responsibilities and processing stages must be documented, and processors must be bound to the relevant safeguards. Applicable health and insurance authority requirements also apply. Storage or support access outside Saudi Arabia must separately satisfy the applicable transfer and sector rules; GCC hosting is not a blanket Saudi authorization.
Health records and statutory retention
Clinical records follow the law applicable to the service and the responsible healthcare organization. For health information within the scope of UAE Federal Law No. 2 of 2019 on ICT in health fields, Article 20 provides a minimum of 25 years from the last health procedure. This is not a blanket period for every website enquiry or ordinary wellbeing entry. HIPAA does not itself set a universal medical-record retention period; its documentation requirements are a separate category. A provider may need to retain its original record independently of an Afiyah account deletion.
Questions and complaints
Contact privacy@getafiyah.com for privacy, permissions, deletion or security concerns, and contact@getafiyah.com for service complaints. Include a brief description and a safe reference; do not attach health records, identity documents, passwords or card details to an initial email. We verify identity and authority before releasing or changing personal data. You may complain to the competent regulator or court without first giving up any statutory right.