Afiyah · Policy notice · 29 October 2026
Security. Protection with accountability.
These requirements govern access, engineering, suppliers and incident handling. Specific assurance claims require evidence for the actual service.
Finding your country preference…
Access and identity
Use person-specific accounts, least privilege and role- and purpose-limited access. Privileged access requires strong authentication, appropriate multi-factor controls and prompt revocation when authority ends. Review sensitive access regularly and after role changes. Separate family permissions, production administration and development access; membership sponsorship does not confer access to a person’s health record.
Data, encryption and secrets
Classify health information as restricted, minimize copies and protect it in transit and at rest with appropriate encryption and key controls. Keep secrets out of public code, browser bundles, email and logs. Use approved channels and trained personnel for sensitive support; staff must not transfer health records to personal mailboxes, public AI tools or unapproved storage.
Engineering and resilience
Separate production from test environments, review changes, validate inputs, scan dependencies, patch risk-based vulnerabilities and restrict deployment authority. Protect endpoints and backups and test restoration before relying on a recovery target. Log consequential access and security events with retention limits. Recovery objectives and service levels must be agreed and tested for the actual service; this page does not advertise an unverified recovery guarantee.
Website controls and suppliers
Public forms use server-side validation, abuse checks and Cloudflare Turnstile verification. A browser tick alone is not proof a request was accepted. Optional analytics exclude form messages, chat and health records. Evaluate suppliers for the data, location, contract, onward processing and security required. Core app health records and associated app personal data follow the GCC commitment in /health-data; website enquiries are processed in the United States.
Incidents and responsible reporting
Report a suspected issue to privacy@getafiyah.com with a public URL, impact and safe reproduction steps. Do not access another person’s data or send credentials. We assess, contain, investigate and document incidents and notify affected people, partners and regulators when the applicable law or agreement requires. Deadlines depend on the event, legal role and jurisdiction. We arrange a safer channel for sensitive evidence when needed.
UAE and Saudi breach notification
For Saudi processing, notify SDAIA within 72 hours of becoming aware of a breach when the trigger in Implementing Regulation Article 24 is met, and notify affected people without undue delay when the corresponding harm or rights threshold is met. Document the assessment and supplement incomplete information with reasons for any delay. UAE notification follows the applicable federal or health-sector trigger, authority and prescribed deadline; this policy does not substitute a universal 72-hour deadline for the UAE rules. Processor contracts must support timely escalation to the responsible controller.
Standards and evidence
ISO information-security, privacy and health-information frameworks inform control design. References to standards are not claims of certification, an independent penetration-test result or regulatory approval. Policies, internal checks, provider assurances and independent audits are different evidence types. We review controls after material changes and at least annually. No system can promise absolute security.
Questions and complaints
Contact privacy@getafiyah.com for privacy, permissions, deletion or security concerns, and contact@getafiyah.com for service complaints. Include a brief description and a safe reference; do not attach health records, identity documents, passwords or card details to an initial email. We verify identity and authority before releasing or changing personal data. You may complain to the competent regulator or court without first giving up any statutory right.