iCenna Patient Privacy Notice

How your personal data is handled in the iCenna mobile app

Version: 1.0

Last Updated: 2026-08-21

This Notice explains, in plain language, how your personal data is handled when you use the iCenna mobile application (the “App”), provided by iCenna Company (commercial registration 4030497928; 8125 Prince Sultan Street, 2086 Ar Rawdah District, Jeddah 23435, Kingdom of Saudi Arabia). We process personal data in accordance with the Saudi Personal Data Protection Law (“PDPL”).

1. Who Is Responsible for Your Data

1. Your medical records (diagnoses, prescriptions, results, appointments created by your clinic or hospital): your healthcare provider is responsible (the “Controller”). iCenna processes these records only on your provider’s behalf and instructions, to show them to you in the App. Requests about the content of your medical records should go to your provider; we will help them respond.
2. Your App account (registration details, login, device information, App settings and usage): iCenna is responsible (the “Controller”) for this data.

2. Data We Collect

1. Account and identity data: name, national ID/Iqama number/passport (where required for identity verification), date of birth , phone number, nationality, email, and occupation.
2. Health data shown in the App: records made available by your healthcare provider, processed on their behalf.
3. Device and usage data: device type, operating system, App version, log and diagnostic data, and notification tokens.
4. Your choices: notification preferences, language, and any consents you give in the App.

3. How and Why We Use Your Data

1. To create and secure your account and verify your identity — to perform our agreement with you and comply with law.
2. To display your health records and deliver appointment reminders, results notifications and service messages — on your provider’s instructions and to perform our agreement with you.
3. To keep the App safe, prevent fraud and fix problems — based on our legitimate (actual) interest in securing the service.
4. To comply with legal obligations and lawful requests of competent authorities.

We do not sell your personal data and we do not use your health data for advertising.

4. Artificial Intelligence

Some App features use AI developed and operated by iCenna (for example, summaries or scheduling assistance). AI processing takes place in the Kingdom of Saudi Arabia. AI features only provide suggestions — your care decisions always remain with you and your healthcare professionals.

5. Where Your Data Is Stored and Who Sees It

Your data is stored in

data centres located in the Kingdom of Saudi Arabia. We share it only with:

your healthcare provider; service providers who help us run the App (listed at

https://iCenna.com/sub-processors), under strict contracts; and competent authorities

where the law requires. Any transfer outside the Kingdom happens only as

permitted by the PDPL, with appropriate safeguards.

6. How Long We Keep Data

We keep your App account data for as long as your account is active and as required by law, then delete or anonymise it. Retention of your medical records is determined by your healthcare provider and applicable health-records laws.

7. Your Rights

Under the PDPL you have the right to know how your data is processed, to access and receive a copy of it, to request correction of inaccurate data, to request deletion (subject to legal retention requirements), and to withdraw consent where processing is based on consent. To exercise these rights for your App account data, contact

us at DPO@iCenna.com; for your medical records, contact your healthcare provider. You may also complain to the Saudi Data & AI Authority (SDAIA).

8. Children and Guardians

App accounts are for adults (18+). Parents and legal guardians may access a dependant’s information through the features provided for that purpose, in accordance with applicable law and the healthcare provider’s procedures.

9. Security

We protect your data with safeguards appropriate to its sensitivity, including encryption in transit and at rest and strict access controls. If a breach likely to harm you occurs, we and/or your provider will notify the competent authority and affected individuals as the PDPL requires.

10. Changes and Contact

We may update this Notice; material changes will be notified in the App.

Questions or requests:

Privacy Office, iCenna Company — Privacy@iCenna.com