Privacy policy

1Who we are and who is responsible for your data

1.1 This policy explains what personal data we collect through the Naqar Digital website, client portal and careers pages, why, who sees it, how long we keep it, and your rights.

1.2 Controller of your data: for all clients and visitors in Egypt and Saudi Arabia at present: Naqar Digital LLC, CR 249994 (Cairo Investment Commercial Registry Office), address: Building 5, Neighbourhood 9, First Settlement, New Cairo, Cairo, Arab Republic of Egypt. This entity runs the Site for both countries and remains the controller after the Saudi branch is registered; the branch details will be added here once registered.

1.3 Data protection officer: the Naqar Digital team currently handles data protection requests at info@naqardigital.com. We will name the officer here once appointed.

1.4 For anything about your data: info@naqardigital.com.

2Scope

2.1 This policy covers Site visitors, people who send a contact or booking request, visitor account holders, newsletter subscribers, Clients and Portal users, and job applicants.

2.2 Our Clients' patient data: when we run campaigns, forms or messaging channels for a healthcare facility, the facility is the controller and we process data on its behalf and instructions. The facility's privacy policy governs that data. For questions about it, contact the facility, and we will help it respond.

3Summary

We do not sell or rent your data, or share it for other companies' marketing.

4Site visitors

4.1 What we collect:

• Country of browsing: our server reads your IP address only to find the country and show that market's prices and currency. This uses a database bundled with the Site; the address is not sent to anyone for this purpose and is not stored with your request. We keep only the resulting country.
• Server logs: the hosting provider may keep technical logs with IP address, time and browser type for security and operation, for 90 days.
• Aggregated usage events: such as opening a page or using the calculator or guide assistant, with no name, email or IP address.
• Your preferences: language, light or dark mode and browsing path (facility or individual), stored in your browser.
• Cookies: per your choice in the consent banner (section 13).
• Site tools: numbers are calculated in your browser. They reach us only if you choose to send them in a request, such as the patient leak check result.

4.2 Purpose: run and protect the Site, show the right prices for your country, understand how the Site is used to improve it, and measure our ads with your consent.

4.3 Legal basis: legitimate interest for running and protecting the Site and showing the right prices; your consent for analytics and advertising cookies.

5Contact and booking requests

5.1 What we collect: name, mobile, email if given, facility name, path (facility or individual), specialty, the service or package of interest, budget or goal if given, your message, the time you chose, your browser's time zone, the page you sent it from, the visit source if you came from a campaign link or another site, the country derived from your IP address, and the time of your consent.

5.2 What we do with it:

• reply to you and send an email confirmation with a calendar file;
• for bookings, create an event and online meeting link in Google Calendar if enabled, showing your name, mobile and message;
• send a signed link to manage or move your booking;
• if we cannot reach you, we may send one follow-up email about the same request;
• rank requests internally with an automatic 0-100 score based on completeness and readiness, to decide which to handle first. The score does not affect your right to a reply and is not used for any other decision;
• keep the history of messages and bookings with the request.

5.3 Legal basis: your consent when submitting the form, and steps taken at your request before a contract.

5.4 WhatsApp: if you choose to message us on WhatsApp, you move to the WhatsApp app, and the chat is subject to WhatsApp's policies as well as this policy.

6Visitor accounts and newsletter

6.1 What we collect: name, email, your role (facility owner or manager, doctor, or other), preferred language, newsletter choice, consent time and last sign-in time.

6.2 Sign-in: by a code sent to your email, valid for a short time with limited attempts. We keep no password you can use.

6.3 Newsletter: a weekly newsletter for facility owners and managers only, with the week's articles. It is not sent in a week with nothing new. You join only with your explicit consent. Every email has a one-click unsubscribe link, and you can also unsubscribe from the account page.

6.4 Deletion: you can delete your account and its data from the account page at any time. It is removed from the database at once; backups are overwritten within 30 days.

6.5 Legal basis: your consent when opening the account, and a separate consent for the newsletter.

7Clients and Portal users

7.1 What we collect:

• facility, contract and billing details;
• Portal team members' name, email, mobile, role and language;
• sign-in and security data: password stored in a form that cannot be read back, authenticator key, recovery codes in protected form, sign-in history and trusted devices;
• work content: files, reports, designs, approvals, comments, requests and invoices;
• ad and analytics account data the Client gives us access to, mostly aggregated figures.

7.2 What we do with it: perform the Agreement, issue invoices, send Portal notices and automatic reminders (such as an invoice coming due, a request awaiting our reply, or a renewal date), and protect accounts.

7.3 Private files are stored outside the Site's public path and open only after checking the user's permission on that account.

7.4 Legal basis: performance of the Agreement; legal obligations such as invoicing and tax; legitimate interest in account security.

8Job applicants

8.1 What we collect:

• name, email, mobile, language, job and level, and a CV in PDF;
• answers, time per question, scores, and ranking among applicants for the same job;
• integrity signals during the assessment: leaving the page or app, copy or select attempts, device and browser type, a random device identifier stored in your browser, and a hashed form of your IP address that does not reveal the address;
• we do not use the camera or microphone, and we do not record the screen;
• a watermark with your email appears on questions to protect the assessment from being shared.

8.2 What we do with it:

• verify your email with a code and send a receipt with a link to continue;
• score the assessment fully automatically, classify it as "shortlisted", "reserve" or "not shortlisted" using internal thresholds, and send you your score and level per area;
• our team contacts shortlisted applicants to set an interview;
• the hiring decision is made by our team at the interview, not by the automated system;
• You may ask for an explanation of your result or a human review of your classification via info@naqardigital.com, and we reply within 30 days.
• you may apply again 6 months after your last assessment.

8.3 Legal basis: your consent when applying, steps taken at your request before a contract, and legitimate interest in a fair assessment.

8.4 Retention: we delete data of applicants who are not hired 12 months after their last activity, including the CV. For people we hire, data moves to the employee file under labour law.

8.5 Please leave unnecessary sensitive data out of your CV, such as health, religion, ID number or photo.

9Legal bases

We process data under the Saudi Personal Data Protection Law and its regulations, and Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.

Where we rely on legitimate interest, we document an assessment balancing our interest against your rights, and you may object as described in section 16.

10Sensitive and health data

10.1 We do not ask you for health data about yourself or any patient, and our services do not need it.

10.2 If your message or upload includes health data about an identifiable person, we use it only to reply to your request, limit access to those who need it, and may ask you to delete it or resend without it.

10.3 A facility's name, specialty or aggregated performance figures are not health data about a person.

11Who sees your data

11.1 The Naqar team handling your request or account, with defined permissions.

11.2 Service providers working for us under contracts that bind them to confidentiality and security:

11.3 Analytics and ad platforms, only with your consent: Google (Analytics, Tag Manager), Meta, Snapchat and TikTok. They act as independent controllers of the data they collect, under their own policies.

11.4 Government or judicial authorities under a lawful request.

11.5 Merger or transfer of business: data moves to the new entity with the same protection, and we tell you.

12Transfers outside your country

12.1 Where data is stored: Site data is stored on servers in the United States.

12.2 Some data may be processed outside Saudi Arabia or Egypt by the providers in section 11, such as Google services, email and ad platforms.

12.3 From Saudi Arabia: we transfer data under the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, limited to the minimum needed, with appropriate safeguards such as the standard contractual clauses issued by the Saudi Data and AI Authority, and a risk assessment where required.

12.4 From Egypt: we transfer data under the Personal Data Protection Law and its Executive Regulations, with the licence or permit required from the Personal Data Protection Center, and only to countries with protection no lower than Egypt's.

12.5 You may ask about the safeguards applied to a transfer at info@naqardigital.com.

13Cookies and browser storage

13.1 On your first visit a banner lets you accept, reject or customise analytics and advertising cookies. No analytics or ad tool loads before you consent. You can change your choice at any time from "Cookie settings" at the bottom of the page.

13.2 Types:

13.3 You can also delete or block cookies in your browser settings. Blocking necessary cookies may prevent sign-in.

14Retention

At the end of each period we delete the data or turn it into aggregated figures that identify no one. We may keep data longer if needed for an open dispute or an authority's request, and only to that extent.

15Security

15.1 Our technical and organisational measures include:

• encrypted connections on every page;
• a second sign-in step for the Portal;
• role-based permissions and an access log for files and CVs;
• short-lived one-time codes with limited attempts;
• private files stored outside the Site's public path;
• regular backups and regular security reviews.

15.2 No system on the internet is free of risk. We keep reviewing and improving our measures.

15.3 If an incident affects your data: we notify the competent authority within 72 hours of becoming aware of it where the law requires (the Saudi Data and AI Authority in Saudi Arabia, the Personal Data Protection Center in Egypt), and we tell you without undue delay what happened and what you can do, within the periods set by law.

16Your rights and how to exercise them

16.1 Your rights:

• To be informed of what we collect and why, as set out in this policy.
• Access: a copy of your data in a clear, readable format.
• Correction: correct, complete or update inaccurate data.
• Deletion or destruction: when the data is no longer needed or you withdraw consent, subject to legal requirements.
• Withdraw consent at any time, without affecting what was done before.
• Object or restrict: to processing based on legitimate interest or for marketing, and restrict processing in the cases set by law.
• Be told of incidents affecting your data, under section 15.3.
• Complain to the competent authority under section 21.

16.2 How to exercise them:

• visitor account holders edit or delete their account directly from the account page;
• for other requests, email info@naqardigital.com from the address we hold and state the right you want to exercise;
• we may ask for proof of identity first, and only what is needed for that;
• requests are free. We may refuse repetitive requests without justification, or charge a reasonable fee for them where the law allows.

16.3 Response time: within 30 days of receiving the request. If more time is needed where the law allows, we tell you why and how long.

16.4 If we refuse a request in whole or part, we explain why in writing and remind you of your right to complain.

17Marketing

17.1 We send marketing messages only with your consent, or within what the law allows for an existing relationship.

17.2 Every marketing message identifies us as the sender and includes an easy, free way to unsubscribe. We stop as soon as you unsubscribe.

17.3 Service messages, such as booking confirmations, sign-in codes, invoices and Portal notices, are not marketing and continue while needed for your request or Agreement.

18Children

18.1 The Site is for professionals and facility owners, not children. We do not accept accounts, requests or job applications from anyone under 18.

18.2 If we learn we collected a child's data without a guardian's consent, we delete it. If you are a guardian and believe this happened, email info@naqardigital.com.

19Links and third-party content

The Site links to other sites and platforms. Data you give them is governed by their policies.

20Changes to this policy

We update this policy when our services or the law change. The last update date appears at the top. For a material change affecting your rights or the purposes of processing, we email account holders and Clients before it takes effect, and ask for new consent where the law requires.

21Contact and complaints

21.1 Contact us first: info@naqardigital.com. We acknowledge within 2 working days.

21.2 If the matter is not resolved, you may complain to:

• Saudi Arabia: the Saudi Data and Artificial Intelligence Authority (SDAIA), through its online complaints platform.
• Egypt: the Personal Data Protection Center, under the Information Technology Industry Development Agency (ITIDA).

21.3 Controller details: as in section 1.2.