Privacy Policy

1. Introduction

Well is a Saudi digital-health platform operated by Well Union, a company licensed by the Saudi Commission for Health Specialties (SCFHS). The platform comprises several integrated health services, with the Well CDM app as its flagship chronic-disease management product.

This Privacy Policy explains what personal and health data we collect from users of our applications, how we use it, who we share it with, and how we protect it — in accordance with Saudi Arabia's Personal Data Protection Law (PDPL) and its implementing regulations.

By using Well apps or services, you consent to the data-processing practices described in this policy.

2. Information we collect

a) Identity data: Full name, date of birth, mobile phone number, optional profile photo, health insurance provider, and family-member relationships added through the Family feature.

b) Sensitive health data: Vital signs including heart rate, blood glucose, blood oxygen saturation (SpO₂), body temperature, weight, blood pressure, and glycated haemoglobin (HbA1c); medication details and daily dose logs; laboratory results including photographed and OCR-extracted reports; care plans issued by your health-care providers; mental-health self-assessments including mood logs and PHQ-9 / GAD-7 scores; women's health data relating to menstrual cycles and pregnancy; and caregiver-linkage records.

c) Technical data: Device type and operating system, in-app usage and feature interactions, and notification preferences.

3. How we collect it

We collect your data from the following sources:

Directly from you: when you register an account, enter vital readings, medication details, or any health information you type into the app.

Your care providers: licensed physicians, pharmacists, and other health professionals who issue care plans, prescriptions, and laboratory results within the Well platform.

Connected glucose devices: if you choose to link a Dexcom or Abbott FreeStyle Libre / LibreView device, continuous glucose readings flow directly into the app subject to your explicit permission.

Apple HealthKit: with your permission, we can read and write health data stored in Apple Health on iOS devices — including heart rate, blood glucose, weight, physical activity, and other HealthKit health types relevant to chronic-care management.

Your camera: with your permission, to capture symptom photos and to scan paper lab reports.

Your calendar: with your permission, to schedule appointments, medication reminders, and dose times that account for prayer times and Ramadan fasting hours.

4. How we use your data

We use your personal and health data for the following purposes:

Care delivery and coordination: enabling secure communication between patient and care provider, displaying care plans, and tracking chronic-disease management progress.

Chronic-disease management: analysing health indicator readings and alerting care providers when defined thresholds are exceeded.

Appointments and reminders: sending medication reminders that respect prayer times and Ramadan Iftar / Suhoor hours, and sending medical appointment reminders.

Prescriptions: facilitating prescription issuance and maintaining medication history.

Service improvement: developing app performance and features based on anonymised usage data.

Legal and health-regulatory compliance: meeting obligations arising from PDPL and Saudi health regulations.

5. Apple HealthKit

Well apps integrate with Apple HealthKit on iOS devices to access and write the following health types, subject to the permissions you grant: blood glucose readings, heart rate, blood oxygen saturation (SpO₂), weight, blood pressure, physical activity, and continuous glucose monitor (CGM) data where available.

Important notice regarding HealthKit:

Apple HealthKit data is never used for advertising or marketing purposes.

Apple HealthKit data is never sold and is never shared with any third party for advertising or marketing purposes.

Apple HealthKit data is used solely to support the direct delivery of health care to you.

Our access to HealthKit data is subject to your explicit permission each time we request HealthKit access, and you can revoke this access at any time via iOS Settings > Health > Data Access & Devices.

6. Connected devices

If you choose to link a continuous glucose monitor from Dexcom or Abbott FreeStyle Libre / LibreView, that connection is established at your explicit request.

Data transmitted from those devices to the Well app is also subject to the privacy policies of those device providers (Dexcom Inc. and Abbott Diabetes Care / LibreView). We encourage you to review those providers' policies directly.

Well receives glucose data from these devices for the sole purpose of supporting your chronic-disease management and does not use it for any other purpose.

7. Sharing and disclosure

We share user data only in the following circumstances:

Your treating clinicians: licensed physicians and health-care professionals linked to your care have access to your health data to the extent required to provide care.

Consented caregivers: if you link a family caregiver account via the Family feature, that caregiver can access the data you designate. All caregiver actions are subject to audit logging.

Service processors: we engage approved service providers under data-protection agreements; these are Supabase for cloud infrastructure and data hosting, Msegat for SMS delivery, Moyasar for payment processing, and ZEGOCLOUD for video-call services where applicable.

Government authorities: we disclose data to competent government bodies where law or a court order requires it, and only to the extent required by those legal obligations.

Important: we do not sell your personal data to any party. We do not use health data in any form for advertising or targeted marketing.

8. Storage and security

Some data is stored locally on your device for fast offline access; cloud data is stored on secured infrastructure managed by Supabase.

We apply multi-layer security controls including: encryption in transit using TLS, encryption at rest at the database level, Row Level Security (RLS) policies that enforce per-user data isolation, access controls with periodic reviews, and audit logs for care-provider and caregiver actions.

9. Retention

Clinical and health records are retained for the period required by Saudi health record-keeping regulation, approximately ten (10) years or longer as required by applicable law.

Other account data is retained until you request deletion of your account, at which point we delete or de-identify your data within the timeframes required by law, except where law or a regulatory body requires longer retention.

10. Your rights under the PDPL

Saudi Arabia's Personal Data Protection Law grants you the following rights:

Right of access: request a copy of the personal and health data we hold about you.

Right of correction: request correction of inaccurate or incomplete data.

Right of deletion: request deletion of your data to the extent permitted by law and applicable legal obligations.

Withdrawal of consent: withdraw your consent to any processing based on consent at any time, without affecting the lawfulness of prior processing.

Right to complain: lodge a complaint with the competent Saudi personal-data protection authority.

To exercise any of these rights, contact us at info@wellunion.co or on 920033719.

11. Children

Well services are intended for users aged 18 and above.

Minors can be supported only through a consenting adult parent or guardian who registers and manages a family account via the Platform's Family feature. The adult responsible for the minor's care bears full responsibility for consenting to the processing of the minor's data.

We do not knowingly collect personal data directly from children under 18 without guardian consent.

12. Data location

Well user data is processed in and for the Kingdom of Saudi Arabia. We seek to ensure that health records and sensitive-category data are stored on servers and cloud facilities operating in the Saudi Arabia region or in regions that provide an equivalent level of adequacy under PDPL.

13. Changes to this policy

We may update this policy periodically to reflect changes in our practices or regulatory requirements. Where we make material changes, we will notify you via an in-app notice, email, or other appropriate means before the changes take effect.

The "Last updated" field at the top of this page indicates the date of the most recent revision. Your continued use of Well apps after changes are posted constitutes acceptance of the updated policy.

14. Contact us

For any question or request relating to this policy or your data rights, please contact us at:

Email: info@wellunion.co

Unified number: 920033719

Well Union — Kingdom of Saudi Arabia, Riyadh.