1. Introduction & Definitions — Hema Blood Infrastructure Company, operating under the trade name “HemaSync” (“Company”/“Platform”), is committed to protecting the privacy, confidentiality, and security of personal and health data processed through its platform in accordance with Saudi Arabia’s Personal Data Protection Law (PDPL), its implementing regulations, and applicable SFDA regulations. Personal Data means data that identifies an individual directly or indirectly; Health Data means historical lab results and associated medical records; Processing includes collection, storage, analysis, sharing, and deletion; and Data Owner means the individual to whom the data relates. 2. Scope — This Policy applies to patients, medical labs, hospitals, healthcare facilities, insurance companies, government entities such as Nafath and Tahaqquq, and third parties acting as processors or recipients under the data owner’s consent. 3. Data We Collect — Identity, health, technical, and government linkage data may be collected, including name, ID or iqama number, date of birth, contact details, laboratory results, test dates, source facility, usage logs, and identity verification data. 4. Sources & Legal Basis — Data is collected directly at registration, from partner facilities with explicit patient consent, and from Nafath solely for identity verification. No health data is processed without explicit and clear consent. 5. Processing & AI — HemaSync consolidates lab records, enables health-trend analysis, allows consented access for healthcare partners, supports insurer programs under detailed purpose-specific consent, and verifies identity. AI insights are guidance-only, not medical diagnosis; data owners may request human review of an automated decision. 6. Sharing & Insurance Controls — Data may be shared with consented partner facilities, contracted insurers for permitted purposes, government identity-verification services, and Saudi cloud processors acting only under HemaSync instructions. Insurers may not use identifiable data to deny coverage, raise premiums, or make adverse individual decisions. Consent may be withdrawn at any time, without affecting separate clinical consents. Aggregated, anonymized analytics may be used for group-level modelling only. 7. Storage, Security & Auditing — Data is stored exclusively in Saudi Arabia with approved providers. HemaSync uses encryption, access controls, audit trails, and periodic security testing. Data owners may request access logs. 8. Retention, Withdrawal & Rights — Data is retained while the account is used and afterward only as legally required, then deleted or anonymized. Data owners may withdraw consent, delete data, or freeze an account subject to retention obligations. PDPL rights include access, correction, destruction, consent withdrawal, source and purpose information, and regulatory complaint. 9. Special Protections — Nafath linkage is limited to identity verification. Minors’ data requires verified guardian consent. Health data receives enhanced protection. Cookies are used for operational and analytical purposes, and third-party links have their own policies. HemaSync preserves received source data but is not responsible for an error originating at a medical facility. 10. Incidents, Requests & Contact — HemaSync will notify SDAIA and affected data owners of a qualifying security breach as legally required. Official government or court requests may require lawful disclosure. Personnel are bound by confidentiality and trained on PDPL and information security. For requests, contact support@hemasync.co. 11. Governance — SDAIA supervises PDPL compliance. This Policy may be updated for legal or service changes, with material changes published on the Platform. The Terms & Conditions govern liability, indemnification, arbitration, ownership of derived analytics, insurance, assignment, suspension, force majeure, and related master contractual matters. Founding Partners warrant lawful collection and sharing of uploaded data, and HemaSync will cooperate with regulatory audits. HemaSync may modify services for regulatory developments with notice of material changes, maintains periodic Saudi-based backups, and does not guarantee uninterrupted service or complete recovery in all major incident scenarios.