سياسة الخصوصيّة Privacy Policy

Introduction

Kayan Charity Association (licensed by the National Center for Non-Profit Sector Development under number 787) respects the privacy of Elaf users. This policy explains what data we collect, why we collect it, whom we share it with, how we protect it, and your rights. By using Elaf, you agree to this policy.

Data We Collect

1) Data You Provide Directly

• Account data: name, phone number, email, gender, date of birth, social status, and academic degree.
• Consultation content: text and voice messages you send to the specialist, results of psychological scales, and treatment plans you join.
• Payments: card information is handled by an approved payment provider; we do not store card numbers on our servers.
• Video sessions (Zoom): sessions are recorded only after your explicit consent when the session begins.

2) Data Collected Automatically

• Device information: operating system, app version, Firebase Cloud Messaging token for notifications.
• IP address and access logs for security and error diagnosis.
• Aggregated usage analytics via Firebase Analytics (does not identify you personally).

How We Use Your Data

• To provide the core service: match you with an appropriate specialist, store your records, deliver notifications.
• To improve service quality and diagnose issues.
• To verify eligibility (many services are free because they are funded by the association, and require eligibility criteria).
• To comply with Saudi laws and healthcare / mental-health regulations.

Whom We Share With

• Specialists: your treating specialist sees only the data needed for the session and is bound by contractual medical confidentiality.
• Technical service providers: Firebase (notifications, aggregated analytics), Zoom (video streaming), payment provider (financial transactions). Each has its own privacy policy meeting protection standards.
• Government authorities: only upon a binding court or regulatory order.
• We do not sell your data under any circumstances.

Data Retention

We retain your account record for as long as it is active. If you request deletion, a 30-day grace period begins — during which you can restore your account simply by signing in. After the period expires, your account is soft-deleted because session records and invoices are linked to it for legal/accounting purposes. Medical data may be retained for the period mandated by the Saudi health system.

Your Rights

• Access to the data we hold about you.
• Correct or update it from within the app.
• Delete your account (see the "Delete Account" page).
• Withdraw your consent to usage analytics from your device settings.
• File a complaint with the Saudi Data & AI Authority (SDAIA) if you believe there has been a violation.

Exercising Data Subject Rights

You may exercise your rights (access / correction / erasure) by contacting us via email:

Email: dmo@kayan.org.sa

Please attach proof of identity (the phone number registered in the app is usually sufficient) so we can securely fulfill your request within the timeframes stipulated by the Personal Data Protection Law.

Where Your Data Is Stored

Account data, consultation content, and session records are stored on servers physically located within the Kingdom of Saudi Arabia in compliance with the Personal Data Protection Law (PDPL) issued by the Saudi Data & AI Authority (SDAIA), inside data centers meeting local security controls.

Cross-Border Data Transfer

Some third-party technical services run on servers outside Saudi Arabia. These are limited to:

• Firebase Cloud Messaging (Google) — for push notifications. Only a device token is sent, never session content.
• Zoom Video Communications — for video sessions. The conversation is streamed in real time only; nothing is stored on Zoom servers unless you explicitly consent to recording.
• Electronic payment provider — to process financial transactions per PCI-DSS standards.

This transfer is permitted under Article 29 of PDPL because it is necessary to fulfill a contractual obligation between you and Elaf, and is subject to contractual safeguards with each provider.

Compliance With Saudi Regulations

• Personal Data Protection Law (PDPL) — issued by Royal Decree No. (M/19) of 1443 AH and its executive regulations.
• Supreme Order No. 51224 — regarding protection of health-service beneficiaries' data.
• Saudi Commission for Health Specialties (SCFHS) regulations — for practicing health professions and psychological consultations.

Data Security

• Communication between the app and the server uses HTTPS/TLS with signature verification (HMAC-SHA256).
• Passwords are hashed with bcrypt.
• Voice data and attachments are stored on private storage and served via time-limited signed URLs.
• Database access is restricted to a limited technical team at Kayan, with a full audit log for every operation.
• We perform periodic server security reviews and apply immediate patches for security vulnerabilities.

Children

The service is intended for users aged 13 or older. When registering someone under 18, a legal guardian is required. We do not knowingly collect data from children under 13.

Data Protection Officer

Name: Data Management Office at Kayan Charity Association.

Email: dmo@kayan.org.sa

Complaints and Inquiries

For complaints or inquiries related to this privacy policy or personal data:

Email: info@kayan.org.sa

If we do not respond within 30 business days, you may escalate the complaint or inquiry to the Data Management Office:

Email: dmo@kayan.org.sa

Privacy Policy Updates

The privacy policy was last updated on 2026-07-04. The site administration reserves the right to add or modify any provisions of the privacy policy, with notice to the user, and reserves the right to terminate the account if the user does not accept the changes. The Arabic version is the authoritative language for applying these terms and prevails in the event of any dispute over interpretation of texts in other languages.