Al-Hayat National Hospitals Group ("HNH", "the Group", "we", "us") is committed to protecting the privacy, confidentiality, and security of the personal and health data of our patients, visitors, employees, and business partners across all our hospitals and facilities in the Kingdom of Saudi Arabia. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and the rights available to individuals under applicable law.

This Policy is issued in accordance with the Personal Data Protection Law (PDPL) issued by Royal Decree No. (M/19) of 9/2/1443H, its Implementing Regulation, and other applicable regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA), the Ministry of Health (MOH), and the Saudi Central Board for Accreditation of Healthcare Institutions (CBAHI), where relevant.

This Policy applies to all personal data processed by HNH in connection with:

• Outpatient, inpatient, emergency, and specialized clinical services across all HNH branches.

• Appointment booking, whether in person, by phone, through our website, or via our mobile application.

• Telehealth and virtual consultation services, including video, audio, and chat-based visits.

• Insurance verification, billing, and claims processing.

• Marketing communications, surveys, and patient experience programs.

• Employment, recruitment, and vendor or partner relationships.

HNH offers telehealth and virtual consultation services, allowing patients to consult with physicians remotely via video, audio, or secure chat through our website, mobile application, or approved third-party telehealth platforms. This Section applies in addition to, and not instead of, the other provisions of this Policy.

• Data collected during a virtual consultation may include audio and video streams, chat messages, uploaded images or documents, session date and duration, and technical data needed to establish and maintain the connection.

• Virtual consultations are documented in the patient's medical record in the Hospital Information System (HIS) in the same manner as in-person visits, including diagnosis, treatment plan, and any prescriptions issued.

• Sessions are not routinely recorded. Where a recording is made for clinical documentation, quality assurance, or training purposes, it is done only with the patient's prior consent, stored securely, and retained subject to the same retention rules as other medical records.

• Virtual consultations are transmitted over encrypted connections. Patients are responsible for ensuring a reasonably private and secure environment on their own end of the call.

• Where a third-party telehealth platform is used, that provider acts as a data processor on HNH's behalf under a written data-processing agreement, and does not use patient data for its own purposes.

• Telehealth services are subject to the applicable MOH regulations governing the practice of remote medical consultation in Saudi Arabia.

3.1 Identity and Contact Data

• Full name, national ID / Iqama number, date of birth, gender, nationality.

• Phone number, email address, residential address.

3.2 Health and Medical Data

• Medical history, diagnoses, treatment plans, prescriptions, and lab or radiology results.

• Vital signs, allergies, immunization records, and clinical notes recorded in the Hospital Information System (HIS).

3.3 Financial and Insurance Data

• Insurance policy details, coverage class, claim history, and payment information.

3.4 Technical Data

• Device identifiers, IP address, cookies, and usage data collected through our website and mobile application.

We process personal data strictly for purposes that are necessary, proportionate, and consistent with the reason the data was collected, including:

• Providing diagnosis, treatment, and continuity of clinical care.

• Scheduling appointments and coordinating referrals between HNH branches and partner facilities.

• Verifying insurance eligibility and processing claims with payers.

• Complying with legal, regulatory, and MOH reporting obligations.

• Quality improvement, accreditation, and patient safety monitoring.

• Sending appointment reminders, health awareness content, and — only with consent — marketing communications.

We rely on one or more of the following legal bases recognized under the PDPL:

• Explicit consent of the data subject, obtained prior to collection wherever required.

• Necessity for the provision of healthcare services or to protect vital interests in emergencies.

• Compliance with a legal obligation imposed on HNH under Saudi law.

• Legitimate interest, balanced against the rights and expectations of the individual.

HNH does not sell personal data. Data may be shared, on a need-to-know basis and under appropriate contractual safeguards, with:

• Treating physicians and clinical staff across HNH branches involved in a patient's care.

• Insurance companies and third-party administrators for eligibility and claims purposes.

• Government entities, including the Ministry of Health, SDAIA, and other regulators, where legally required.

• Accredited laboratories, referral hospitals, or specialized centers for onward treatment.

• Technology and marketing service providers acting as data processors under written data-processing agreements.

Any cross-border transfer of personal data is subject to the safeguards and approvals required under the PDPL Implementing Regulation.

HNH implements administrative, technical, and physical safeguards designed to protect personal and health data against unauthorized access, alteration, disclosure, or destruction. These include role-based access controls within the HIS, encryption of data in transit and at rest, audit logging, and regular staff training on confidentiality obligations.

Medical records are retained in accordance with MOH regulations and HNH's records retention schedule, which generally requires retention of clinical records for a minimum period established by applicable health regulations. Data no longer required for these purposes is securely archived or disposed of.

In accordance with the PDPL, individuals have the right to:

• Be informed about the purposes and manner of data collection.

• Request access to their personal data held by HNH.

• Request correction of inaccurate or incomplete data.

• Request destruction of personal data no longer necessary for the purposes collected, subject to legal retention requirements.

• Withdraw consent for marketing communications at any time.

• Lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

Requests may be submitted through the Patient Relations Office at any HNH branch or via the contact details in Section 12.

Our website and mobile application use cookies and similar technologies to improve functionality, remember preferences, and analyze usage patterns. Users may control cookie preferences through their browser or device settings.

Where care is provided to a minor, personal and health data is collected and processed in coordination with, and with the consent of, the minor's legal guardian, in accordance with applicable regulations.

For questions, requests, or concerns regarding this Privacy Policy or the handling of personal data, please contact:

• Data Protection / Patient Relations Office — Al-Hayat National Hospitals Group

• Email: info@hayathospitals.com

• Website: https://hayathospitals.com

• Phone: 920000094

• Address: HNH Head Office, Kingdom of Saudi Arabia

HNH may update this Privacy Policy from time to time to reflect changes in law, regulation, or our practices. The updated version will be published on our website and, where appropriate, communicated to patients directly.