Privacy Policy

Who we are and the scope of this notice

Rheumatism Association is a Saudi-licensed nonprofit organisation, licence number 773. This notice covers the Association website, contact pages and digital services operated directly by the Association.

When you follow a link to an external portal or platform, that service identifies its operator and applies its own terms and privacy notice, in addition to the Association’s legal obligations where the Association remains a data controller.

Personal data we may process

The data involved depends on the service you choose; not every category is collected from every visitor.

• Contact details such as your name, telephone number, email address and message content.
• Beneficiary and service-request information, which may include identity, eligibility, health and financial documents when requested through the official channel.
• Recruitment information, CVs and supporting documents voluntarily submitted by an applicant.
• Technical information needed for operation and security, such as network address, browser type, error logs and cookies.

Why we process personal data

• To respond to enquiries, complaints and suggestions.
• To assess service and recruitment applications and communicate about them.
• To operate and protect the website, prevent misuse and resolve faults.
• To meet legal and regulatory obligations and retain required records.
• To improve service experience and measure performance using aggregated or limited data where possible.

How data is collected and the legal bases used

Data is collected directly when a person or authorised representative submits it through a form, portal, email or official contact channel. Limited technical data may be collected automatically when the website is used, and limited data may be received from an authorised partner where it is necessary for a service.

The applicable legal basis depends on the purpose and the data involved: consent—including explicit consent for sensitive data where required—steps taken at the data subject’s request, compliance with a legal obligation, or a legitimate interest that has been assessed and is permitted by law. No single basis is assumed for every processing activity.

Health data and children’s data

Health information is sensitive personal data. Do not send medical reports or identity documents through public comments or social media; use only the designated service portal or official application form.

When submitting information about a child or a person lacking legal capacity, the applicant must be an authorised parent, guardian or representative and should provide only the information necessary for the service.

Sharing and service providers

The Association may use hosting, email, security, form, storage and service-portal providers to deliver the requested service. Access is limited to what is needed for that service or a legal requirement, and personal data is not sold to third parties.

Any disclosure to a competent authority, or any transfer of data outside Saudi Arabia where applicable, is subject to the relevant legal requirements and safeguards.

Retention and security

The Association retains data for as long as needed for the purpose for which it was collected, or for the period required by law and approved retention policies, after which it is securely deleted or anonymised. A form may state a specific retention period for that application type; that stated period governs the form.

Appropriate organisational and technical measures are applied according to the nature of the data, with access limited to authorised people and service providers.

Your rights

Subject to the Saudi Personal Data Protection Law and applicable regulations, a data subject may request the following where applicable:

• Information about how and why data is collected.
• Access to personal data and a copy of it.
• Correction, completion or updating of personal data.
• Deletion where the legal conditions are met.
• Withdrawal of consent where consent is the basis for processing, without affecting lawful processing that took place before withdrawal.

Requests may be submitted through the contact email below. The Association handles them within the statutory period, ordinarily 30 days, subject to any permitted extension and notice under the regulations.

Cookies and external services

The website may use cookies required for operation, security and display preferences. Embedded services and external links—such as maps, video, form or payment portals—may use their own technologies when opened.

You can manage cookies through your browser settings; disabling required cookies may prevent some functions from working.

Questions and complaints

Contact the Association first through the email below to exercise a right, ask a question or object to the handling of personal data. Information needed to verify identity may be requested to protect the data subject.

If a complaint is not resolved, the data subject may submit it to the Saudi authority responsible for personal data protection through that authority’s published channels and within the applicable statutory period.

Changes to this notice

The Association may update this page when services or legal requirements change. The version and last-updated date appear at the top of the page, and material changes will be communicated through an appropriate channel.