Privacy Policy & Clinical Data Protection at Bidaya Physiotherapy

In accordance with the fundamental principle of data minimization under the Saudi PDPL, Bidaya collects and processes only the information strictly necessary to design, deliver, and coordinate safe in-home physical therapy protocols. Data categories encompass:

1. Identification and Scheduling Coordinates: Patient's full legal name, caregiver or legal guardian contact details, verified mobile phone number, and residential address (city, district, and villa/apartment location) within the Eastern Province to ensure timely clinician dispatch.

2. Clinical History and Medical Records: Physician referral documentation, surgical operative summaries (such as total joint arthroplasty, spinal fixation, or fracture repair reports), radiological findings (MRI, CT scans, X-rays), laboratory results, and documented comorbidities (including diabetes mellitus, hypertension, cardiopulmonary disorders, and osteoporosis) to calibrate exercise intensity and identify physiological precautions.

3. Functional, Biomechanical, and Environmental Assessment Data: Objective clinical measurements gathered during the initial physical examination, including active and passive joint range of motion (ROM), manual muscle testing grades (MMT), validated balance metrics (Berg Balance Scale, Timed Up and Go test), and home architectural evaluations (staircases, thresholds, floor textures) to identify fall hazards.

4. Clinical Coordination and Communication Records: Secure documentation of telephone inquiries, intake questionnaires, and encrypted WhatsApp correspondence through our official coordination desk (+20 109 707 9170) regarding appointments, symptom progression, and home exercise compliance.

All data processing activities performed by Bidaya Physiotherapy are grounded in explicit statutory authorizations established under the Saudi Personal Data Protection Law and its Executive Regulations:

1. Explicit and Informed Consent: We ensure that patients, or their legally authorized representatives (in the case of minors or functionally incapacitated individuals recovering from severe stroke or cognitive decline), grant documented, informed consent prior to clinical assessment and file creation.

2. Vital Interests and Emergency Escalation: Under urgent circumstances where sudden clinical deterioration threatens patient life or physiological stability, our clinicians are ethically and legally authorized to share essential medical facts with emergency responders (Saudi Red Crescent 997 or National 911) to safeguard vital interests.

3. Inviolable Domestic Sanctity and Strict Photography Ban: Our licensed male therapists honor the privacy of private homes throughout the Eastern Province. Photography or audio-visual recording of patients, residential interiors, or family members is strictly prohibited. In rare instances where photographic range-of-motion verification is clinically indispensable, it is conducted exclusively with prior written authorization, focusing strictly on the isolated joint without identifying features, and archived in an encrypted offline clinical repository.

Bidaya Physiotherapy implements industry-standard technical, organizational, and physical safeguards to prevent unauthorized access, tampering, data leakage, or destruction:

1. End-to-End Encryption in Transit and at Rest: All data transmitted across our website, intake portals, and lead capture forms is secured using modern HTTPS protocols backed by SSL/TLS 256-bit certificates. Stored data is safeguarded using robust AES-256 cryptographic standards.

2. Role-Based Access Controls (RBAC): In adherence to the principle of least privilege, full medical charts and operative reports are accessible exclusively to the designated licensed male physiotherapist and the clinical supervisory director. Administrative personnel are restricted to scheduling coordinates (patient name, contact telephone, and geographic district).

3. Secure Cloud Hosting and Redundant Backups: Our database architecture operates on secure server infrastructure fortified with automated intrusion detection systems (IDS/IPS) and routine security patches. Encrypted daily backups guarantee record integrity and continuity of care for patients requiring extended rehabilitation.

4. Non-Disclosure to External Third Parties: We do not disclose, commercialize, or transfer patient demographic or medical data to private insurance marketers, pharmaceutical brokers, or third-party digital advertising networks.

The Saudi Personal Data Protection Law guarantees patients and beneficiaries specific enforceable rights, which Bidaya actively upholds and facilitates:

1. Right to Information and Transparency: Patients have the right to be informed of the statutory legal basis, purpose, and retention criteria governing their personal and medical information.

2. Right of Access and Portability: Patients or their authorized guardians may request a clear, legible copy of their comprehensive in-home clinical evaluation report, exercise prescription, and documented progress milestones.

3. Right to Rectification: If contact numbers, surgical details, or health status undergo modification, patients may request immediate corrections without fee.

4. Right to Erasure and Deletion: Beneficiaries may request the destruction or deletion of their personal contact data upon conclusion of their rehabilitation episode, subject only to statutory healthcare obligations mandating clinical record preservation for professional liability defense.

5. Right to Withdraw Consent: Patients may withdraw consent for routine non-clinical follow-up communications at any time by contacting our medical coordination desk.

The Bidaya Physiotherapy web platform utilizes a minimal set of functional technical cookies designed exclusively to maintain operational integrity, platform stability, and user experience:

1. Essential Operational Cookies: These cookies preserve user language selections (Arabic/English) and facilitate seamless multi-page navigation without session disruption or interface anomalies.

2. Aggregated Anonymous Performance Metrics: We may analyze anonymized, non-identifying metrics (such as page load duration, device categories, and aggregated section views) strictly to optimize website responsiveness. We explicitly enforce zero collection of Personally Identifiable Information (Strictly Zero PII) across all analytical touchpoints.

3. Browser Configuration Control: Visitors retain full autonomy to restrict or disable cookies through their local browser settings. Restricting non-essential cookies will not impair your ability to review educational medical articles or schedule home evaluations.

Should you have inquiries regarding this Privacy Policy, wish to exercise statutory data protection rights, or desire to communicate feedback regarding domestic privacy during a home visit in the Eastern Province, contact our Clinical Governance and Coordination Directorate directly:

- Official Direct Coordination Desk: (+20 109 707 9170) - Verified Business WhatsApp Line: (201097079170) - Official Privacy & Governance Email: contact@bidayaphysio.com - Geographic In-Home Service Coverage: Dammam, Al Khobar, Dhahran, Qatif, Saihat, Jubail, and Al Ahsa, Eastern Province, Kingdom of Saudi Arabia. - Coordination Desk Working Hours: Saturday through Thursday from 8:00 AM to 10:00 PM, and Friday from 1:00 PM to 9:00 PM (Arabian Standard Time).

All inquiries involving domestic privacy or patient data security are reviewed under the direct supervision of our Clinical Medical Director, guaranteeing rapid, transparent, and respectful resolution.