Introduction

Princess Nourah bint Abdulrahman University is a comprehensive un​iversity for women. In line with its commitment to safeguarding users’ information and maintaining the confidentiality and privacy of personal data in accordance with applicable laws and regulations, the University has developed this Privacy Policy to explain how personal data is collected, the purposes for which it is processed, the methods by which it is shared, exchanged, disclosed, and stored, as well as the rights of personal data subjects.

Use of the University’s website constitutes the user’s acceptance of this Privacy Policy, in accordance with the legal requirements set forth under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.

The University and King Abdullah bin Abdulaziz University Hospital, operating under the University’s umbrella, also affirm their commitment to protecting the privacy and confidentiality of the personal data of all beneficiaries of their services in accordance with the provisions of the Saudi Personal Data Protection Law, its Implementing Regulations, and the relevant national regulations and standards, including the policies issued by the Saudi Data and Artificial Intelligence Authority (SDAIA) and the National Data Management Office (NDMO).

Objectives

This Policy aims to strengthen compliance with the provisions of the Personal Data Protection Law and its Implementing Regulations, adopt best practices for privacy and personal data protection, empower personal data subjects to exercise their statutory rights, and safeguard the privacy of their personal data.

Policy Statement

First: University Information and Activities

Princess Nourah bint Abdulrahman University: Princess Nourah bint Abdulrahman University is one of the world’s largest comprehensive universities for women. It offers academic programs, conducts scientific research, and implements developmental initiatives that contribute to serving the national economy and society. The University also encompasses King Abdullah bin Abdulaziz University Hospital.

King Abdullah bin Abdulaziz University Hospital: King Abdullah bin Abdulaziz University Hospital is a teaching hospital located on the southern side of the University campus. It includes outpatient clinics, emergency and inpatient departments, Centers of Excellence in Women’s Health, Adolescent Health, and Child Growth and Development, in addition to a range of specialized clinics. The Hospital integrates healthcare delivery with education and research while maintaining a strong commitment to quality and patient safety.

Second: Contact Information

For any inquiries or to exercise any rights under this Policy, please contact us through the following channels:

• Responsible Department: Data Management Office, Princess Nourah bint Abdulrahman University.
• Address: Airport Road, Princess Nourah bint Abdulrahman University Campus, Riyadh, Kingdom of Saudi Arabia.
• Email: dmo@pnu.edu.sa

Third: Date of the Latest Policy Update

This Privacy Policy was last updated on 28 January 2026.

Fourth: Personal Data Collected

The University and the Hospital are committed to collecting only the minimum amount of personal data necessary to provide services related to their activities. The collected data is classified in accordance with the National Data Classification Policy issued by the Saudi Data and Artificial Intelligence Authority (SDAIA), as well as the Personal Data Protection Law and its Implementing Regulations, as follows:

• Basic Personal Data: Full name, gender, national identity or residence (Iqama) number, nationality, date of birth, marital status, personal photograph, academic qualifications, and other identifying information that may be required by the University.
• Contact Information: Telephone numbers, email address, and residential address.
• Electronic Account Information: Login credentials for University platforms and applications, including usernames, passwords, and associated contact information.
• Financial Information: Bank account details, payment card information, and payment transaction details.
• Health and Medical Information: Medical records, laboratory and diagnostic test results, diagnoses, medical reports, appointment information, medication and treatment records, and health insurance information.
• Educational Information: Academic qualifications, academic records, grades, enrollment information, and attendance records.
• Technical Information: Internet Protocol (IP) address, device type, operating system, and cookies.
• Other Information: Audio recordings from customer service interactions, employment-related information, information relating to companions accompanying patients receiving healthcare services, and any additional information required to provide services or comply with legal and regulatory obligations.

Fifth: Methods of Collecting Personal Data

• Direct Collection from Personal Data Subjects: Through electronic forms, registration on University platforms, applications for services, communication with customer service, email correspondence, telephone communications, and in-person visits.
• Indirect Collection: Through integration of the University’s and Hospital’s internal systems, National Single Sign-On (Nafath) platforms, automatic collection of technical information, and other legally authorized third parties.

Sixth: Purposes of Collecting and Processing Personal Data

• Creating user accounts and providing educational and healthcare services.
• Managing appointments and delivering healthcare services, including diagnosis and clinical follow-up.
• Communicating with beneficiaries to provide support and respond to inquiries and complaints.
• Fulfilling legal and regulatory obligations and verifying identities.
• Processing financial transactions and collecting applicable fees.
• Improving and developing the quality of services and conducting research studies.
• Supporting recruitment, training, academic assessment, and healthcare evaluation.
• Ensuring compliance with applicable laws and regulations.

The University and the Hospital process personal data based on the following lawful grounds in accordance with the Saudi Personal Data Protection Law and its Implementing Regulations:

• The explicit consent of the personal data subject.
• Compliance with a legal or contractual obligation, including obligations arising from healthcare, education, or employment regulations.
• The protection of public interest or necessity, such as safeguarding public health, safety, or human life.
• The pursuit of the legitimate interests of the University or the Hospital, provided such interests do not prejudice the rights of the personal data subject.
• The fulfillment of research, educational, and healthcare objectives in accordance with the applicable regulatory requirements.

Seventh: Statutory Exceptions to the Requirement for Consent to Process Personal Data

Under the Personal Data Protection Law, obtaining the data subject’s consent for processing personal data is not required in the following circumstances:

• Where the processing achieves a legitimate benefit for the data subject and it is impossible or impracticable to contact them.
• Where the processing is required under another law or is necessary for the implementation of a prior agreement to which the personal data subject is a party.
• Where the University or the University Hospital, as a public entity, is required to process the data for security purposes or to fulfill judicial requirements.

Eighth: Circumstances Under Which Personal Data May Be Disclosed

The University and the Hospital are committed to refraining from disclosing personal data except where permitted by law or for the purposes specified in this Policy. Personal data may be disclosed, where necessary, only to the following parties:

• Government entities and official authorities legally authorized to receive such data.
• Data processors contracted by the University or the Hospital to provide specific services under confidentiality, personal data sharing, or data exchange agreements.
• Other parties inside or outside the Kingdom of Saudi Arabia where disclosure is necessary to implement an agreement, comply with a legal requirement, or protect a legitimate interest, while adhering to all applicable legal controls.
• Research and educational institutions, provided that personal data is anonymized where necessary and processed in accordance with the applicable regulations.

Personal data will not be disclosed for direct marketing purposes without the explicit consent of the data subject.

Ninth: Storage and Protection of Personal Data

• Storage Location: Personal data is securely stored on the University’s and the Hospital’s servers within the Kingdom of Saudi Arabia or, where necessary, through licensed cloud computing service providers in compliance with the requirements of the relevant regulatory authorities.
• Retention Period: Personal data is retained only for the period necessary to fulfill the purposes for which it was collected or as otherwise required by applicable laws and regulations. Upon the expiration of the legally prescribed retention period, the data is securely destroyed in a manner that prevents its recovery, reuse, or re-identification.
• Security Measures and Safeguards: The University and the Hospital implement comprehensive technical, organizational, and administrative security measures, including encryption, data anonymization, access control, and periodic audits, to prevent unauthorized access, data loss, unauthorized disclosure, or data breach incidents.

Tenth: Your Rights Regarding the Processing of Your Personal Data

Pursuant to the Personal Data Protection Law, personal data subjects are entitled to the following rights:

• The Right to Be Informed: including being informed of the legal basis for collecting personal data and the purposes of its collection.
• The Right of Access: to personal data held by the University and the Hospital, in accordance with the applicable laws and regulations.
• The Right to Obtain a Copy: of personal data in a clear and readable format, subject to the applicable regulatory requirements.
• The Right to Request Correction, Completion, or Updating: of personal data.
• The Right to Request Destruction: of personal data that is no longer required, without prejudice to any legal obligations requiring its retention.

Some or all of these rights may be subject to statutory exceptions or exemptions under applicable laws and regulations and will be assessed on a case-by-case basis.

Eleventh: Complaints and Objections Procedure

If you have any inquiry, objection, or wish to exercise any of your rights relating to personal data, you may contact the Data Management Office at Princess Nourah bint Abdulrahman University and King Abdullah bin Abdulaziz University Hospital via:

dmo@pnu.edu.sa

If no response is received within ten (10) business days, you may submit a complaint to the competent authority, namely the Saudi Data and Artificial Intelligence Authority (SDAIA).

• Address: Riyadh, Kingdom of Saudi Arabia.
• Website: Saudi Data and Artificial Intelligence Authority (SDAIA)
• National Data Governance Platform: dgp.sdaia.gov.sa

Twelfth: Availability and Updates of the Privacy Policy

• This Privacy Policy is made available through all official channels of the University and the Hospital in a clear and accessible format. It is reviewed and updated periodically to reflect any legal or operational changes. Beneficiaries may review the update history on the official website or request the latest version using the contact information provided above.
• Princess Nourah bint Abdulrahman University and King Abdullah bin Abdulaziz University Hospital affirm that protecting personal data and privacy is a top priority. They remain committed to the continuous enhancement of policies and procedures to ensure the highest standards of security, transparency, and compliance with the legal and regulatory requirements of the Kingdom of Saudi Arabia.