privacy policy

Privacy Policy – Andalusia Hospitals (Egypt & KSA)

Andalusia Hospitals (“Andalusia”, “we”, “us”, “our”) is committed to protecting the privacy and confidentiality of patients, website visitors, and all users of our digital services in Egypt and the Kingdom of Saudi Arabia. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our websites, mobile applications, online booking services, or communicate with us through any digital channel.

1. Scope of this policy

This policy applies to:

Visitors and users of Andalusia websites and mobile applications in Egypt and KSA.
Patients and their companions who submit data online for appointments, medical inquiries, complaints, or feedback.
Any other individual who interacts with us through our digital platforms.

This policy does not replace your rights under applicable health, data protection, or medical confidentiality laws in Egypt and KSA, and it operates in addition to any consent forms or medical documents you sign at our facilities.

2. Types of data we collect

Depending on how you interact with us, we may collect the following categories of data:

Identification and contact information: name, national ID or residence ID, passport number, date of birth, gender, address, email address, mobile and phone numbers.
Appointment and administrative data: booking details, preferred doctor or clinic, visit history, payment information (excluding full card details where not required), insurance information, and authorization numbers.
Health and medical information: symptoms, medical history, diagnoses, prescriptions, laboratory results, imaging, treatment plans, allergies, and any health information you provide via our digital forms or telemedicine services.
Technical and usage data: IP address, device type, browser type and version, operating system, approximate location, pages visited, time and date of visits, and cookies or similar tracking technologies used on our platforms.
Communication data: messages, inquiries, complaints, feedback, and call records where applicable, as well as any documents or files you upload.

3. How we collect your data

We collect data through:

Forms you complete on our websites and mobile apps (appointment booking, contact us, careers, feedback, etc.).
Your visits and treatment at Andalusia hospitals, clinics, centers, and emergency units.
Communication via phone, email, SMS, social media, or messaging applications we officially use.
Cookies and similar technologies when you browse our websites or use our applications, subject to applicable laws and your consent where required.

4. Legal basis and purposes of processing

We process your personal data only when there is a clear legal basis and for specific purposes, which may include:

Providing medical and healthcare services, including diagnosis, treatment, follow-up, and continuity of care.
Managing appointments, registrations, admissions, discharges, and billing or insurance claims.
Complying with legal and regulatory obligations, including requirements of Ministries of Health, health authorities, and other competent regulators in Egypt and KSA.
Ensuring patient safety, quality improvement, medical audits, and risk management.
Responding to your inquiries, complaints, and requests, and providing customer support.
Improving and developing our websites, apps, and services, including security, performance, and user experience.
Sending you service messages such as appointment reminders, preparation instructions, and follow‑up notifications.
With your explicit consent where required, sending health awareness content, surveys, and marketing or promotional messages related to Andalusia only, which you can opt out of at any time.

5. Sharing and disclosure of data

Andalusia respects the confidentiality of your data and does not sell your personal data. Data may be shared only in limited cases, including:

Within Andalusia Group entities and authorized medical staff involved in your care, strictly on a need‑to‑know basis.
With external healthcare providers, laboratories, pharmacies, or medical professionals when necessary to provide or complete your treatment, and where permitted by law.
With insurance companies and third‑party payers to verify coverage, process claims, and obtain approvals.
With governmental, regulatory, or judicial authorities when we are legally required to do so or to protect your vital interests or the safety of others.
With trusted service providers (such as IT hosting, cloud services, communication platforms, or analytics providers) who process data on our behalf under strict confidentiality and security obligations and in line with applicable data protection laws.

When data is transferred between Egypt and KSA, or to another country, this is done only where permitted by applicable law and with appropriate safeguards to protect your data.

6. Data protection and security

Andalusia applies appropriate technical, administrative, and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures may include:

Encryption, firewalls, secure servers, and access controls.
Limiting access to medical and personal data to authorized staff only.
Regular monitoring, audits, and staff training on privacy and information security.

Despite our efforts, no system can be completely secure. You are also responsible for keeping your account credentials confidential and for notifying us immediately of any suspected unauthorized use.

7. Data retention

Your personal data and medical records are retained only for as long as necessary for the purposes described in this policy and to comply with:

Legal and regulatory requirements in Egypt and KSA regarding medical record retention.
Professional standards and best practices in healthcare.

When data is no longer needed, it will be securely deleted, anonymized, or archived in accordance with applicable laws.

8. Your rights

Subject to applicable law, you may have the right to:

Access your personal data and request a copy where permitted.
Request correction or updating of inaccurate or incomplete data.
Request deletion of your data in specific circumstances where continuing to process it is not legally required.
Object to or restrict certain processing activities, especially for direct marketing.
Withdraw your consent for optional uses such as marketing, without affecting the lawfulness of processing based on consent before withdrawal.

To exercise your rights, please contact us through the channels listed in the “Contact us” section. Some requests may be subject to identity verification and legal limitations.

9. Cookies and online tracking

Our websites and applications may use cookies and similar technologies to:

Enable core functions such as login, appointment booking, and security.
Understand how visitors use the website to improve content and performance.
Remember your preferences, such as language and location.

Where required by law, you will be informed about cookies and given the choice to accept or manage them. You can also control cookies through your browser settings, but disabling some cookies may affect website functionality.

10. Children’s data

Andalusia provides healthcare services to children and minors. Their personal and medical data are collected and processed with the consent of a parent or legal guardian, in line with applicable law, and are protected with the same high level of confidentiality and security.

11. Third‑party websites and links

Our platforms may contain links to third‑party websites or services that are not controlled by Andalusia. This Privacy Policy does not apply to those websites. You are encouraged to review the privacy policies of any third‑party sites you visit.

12. Updates to this policy

Andalusia may update this Privacy Policy from time to time to reflect legal requirements or changes to our practices or services. The updated version will be published on our websites with the “last updated” date. Continued use of our digital services after any update constitutes your acknowledgment of the updated policy.

13. Contact us

For questions about this Privacy Policy, or to exercise your privacy rights, you can contact Andalusia through:

Official websites of Andalusia in Egypt and KSA (contact us forms).
The customer service numbers published on our official platforms.
The dedicated email address for privacy or data protection concerns (if provided on your local Andalusia website).