Privacy Policy
This policy explains how data is collected, used, and protected when you use CareNow, a digital intermediary platform that connects people seeking home care and lab tests with licensed service providers.
1. Data we collect
We may collect the following data:
Identity and account data: name, mobile number, email, date of birth, gender, and city.
Data about the family members the user adds.
Booking data: the service, the beneficiary, the appointment, the address, the provider, and the order status.
Optional health data: chronic conditions, allergies, medications, and medical devices.
Payment data and the status of transactions and refunds, without CareNow storing card details.
Messages, attachments, and complaints linked to orders.
Usage and device data, and technical and security logs.
Notification and language settings, and consent to share the health profile.
2. Why we use data
We use data to:
Create the account and verify identity.
Search for services and complete booking and payment.
Share the data a provider needs to fulfil the order.
Track the order status and send notifications.
Handle complaints, refunds, and support.
Protect the account, prevent fraud, and carry out security audits.
Improve the platform's performance and the user experience.
Meet regulatory requirements in the Kingdom of Saudi Arabia.
3. Health data
Health data is treated as sensitive data:
We collect the minimum needed at sign-up.
Completing the health profile is optional.
Answers can be changed or deleted at any time.
Sharing the health profile with providers is off by default.
When sharing is on, the profile is read-only for the provider and the staff member assigned to an accepted order.
Access ends when the order is closed or sharing is turned off.
Every view of the health profile is logged for security and audit.
4. Sharing data
We may share data, only as far as needed, with:
The home-care centers and labs you choose.
The staff member assigned to fulfil the order.
The payment gateway, to process the transaction.
Email, notification, and technical service providers.
Government or regulatory bodies where the law requires it.
We do not sell personal or health data for marketing.
5. Payment
Payments are processed through a secure external payment gateway. Full card details never pass through or are stored on CareNow's servers. We keep only transaction data such as the amount, status, reference number, and refunds.
6. Notifications and marketing
We use notifications to update users about orders, payments, appointments, and complaints. Device notifications can be turned off, but updates remain available in the app.
Tracking tools and marketing pixels are not turned on before the required consent, and we never send them health data or order details.
7. Data retention
We keep data for as long as needed to provide the service and meet legal obligations. When account deletion is requested:
The user is signed out as soon as they confirm.
Personal and health data is deleted or anonymised within the approved period.
We may keep order, payment, and audit records as the law requires, separated from the user's identity as far as possible.
Deletion may not be possible while there are orders that are not closed.
8. User rights
Under the applicable laws, users can ask to:
Access their data.
Correct inaccurate data.
Delete data where the law allows.
Withdraw consent to share the health profile.
Know why their data is collected.
Complain about how their data is processed.
9. Data protection
We apply suitable technical and organisational measures, including access control, encryption, activity logging, and access monitoring. No digital system can be guaranteed to be fully secure, but we work to reduce risks and respond to incidents.
10. Family members' privacy
The account holder is responsible for the accuracy of the data they add for family members, and for having the authority to manage it and use it for bookings.
11. Changes to this policy
We may update this policy when the service or the regulations change. We will show the date of the update, and may ask for new consent if the change is material.
12. Contact
Owning entity: [Legal name]
Email: [Privacy email]
Phone: [Contact number]
Address: [National address]