Privacy Policy

Medad ("Medad", "we", "us", or "our") is an AI-powered clinical platform for healthcare professionals, based in the Kingdom of Saudi Arabia. Medad provides tools including the Clinical Assistant, Drug Search, Clinical Calculators, Clinical Library, Templates, Personal Assistant (email and calendar), Morning Conference, Branding Studio, Education Builder, Clinical Simulation, and Clinical Analytics (together, the "Services").

We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations, and other laws that apply to us.

We collect the following categories of information:

• Account information: your name, email address, and login credentials when you create an account or sign in, as well as your role and organization if you provide them.
• Profile and preferences: settings such as theme, font size, language, privacy choices, and branding personas you create.
• Content you provide: questions you ask the Clinical Assistant, drug searches, notes, templates, custom calculators, simulation cases, conference agendas, education materials, and documents (such as PDFs) you upload to the Clinical Library.
• Images and voice: photos of clinical notes you upload for text extraction, and voice input used for dictation and the voice assistant. Text you choose to have read aloud is converted to speech.
• Connected account data: if you connect your Google account to the Personal Assistant, we access your Gmail messages and Google Calendar events as described in the "Google account data" section.
• Subscription and billing data: your selected plan, subscription status, trial and billing dates, and payment transaction records (such as transaction reference, amount, currency, and date).
• Usage and device data: pages visited, features used, actions taken, approximate usage counts for plan limits, browser type, device information, and log data used to operate and secure the Services.

Medad is designed for use by healthcare professionals. You may enter clinical information while using the Services. You are responsible for ensuring that you have a lawful basis and any required consent to enter patient information, and for complying with your professional, institutional, and legal obligations.

We strongly recommend that you de-identify patient information (remove names, national ID or medical record numbers, dates of birth, contact details, and other direct identifiers) before entering it, and only enter the minimum information needed for your task.

We process patient information you submit only to provide the Services to you, and we do not sell it or use it for advertising.

We use the information we collect to:

• Provide, operate, and maintain the Services, including generating AI responses and documents you request;
• Create and manage your account, free trial, and subscription;
• Process payments, prevent duplicate trials, and enforce plan features and usage limits;
• Save your history, templates, library resources, and preferences so you can access them later;
• Send service messages, such as receipts, trial reminders, security notices, and support replies;
• Send product updates and marketing communications, if you have not opted out in your privacy settings;
• Monitor, secure, troubleshoot, and improve the Services; and
• Comply with legal obligations and enforce our Terms & Conditions.

Many Medad features use artificial intelligence. When you use these features, the content you submit (for example, a clinical question, uploaded document, note photo, or email you ask us to summarize) is sent to AI model providers through our platform infrastructure to generate a response.

AI-generated output can be incomplete or inaccurate. It is provided to support, not replace, your professional clinical judgment. Please review our medical disclaimer.

The Personal Assistant lets you optionally connect your Google account. If you do, and only with your permission, we request access to:

• Gmail: to read, triage, summarize, label, and send emails on your instruction;
• Google Calendar: to view your events, suggest meeting times, and create or update events on your instruction; and
• Basic profile: your name, email address, and profile picture to identify the connected account.

Medad's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the Personal Assistant features you use. We do not sell it, use it for advertising, or allow humans to read it except with your consent, for security purposes, or where required by law.

You can disconnect your Google account at any time from Medad settings, or revoke access from your Google Account permissions page.

We do not sell your personal data. We share information only as follows:

• Service providers that process data on our behalf, under contractual confidentiality and security obligations, including:
  • Base44, for application hosting, authentication, data storage, and AI processing;
  • PayTabs, for payment processing;
  • Google, when you choose to connect Gmail or Google Calendar; and
  • ElevenLabs, for text-to-speech in voice features.
• Your organization: if you use an Enterprise plan, your organization's administrators may manage your account and view team activity such as shared simulations and conferences.
• Other users, at your direction: for example, when you join a team simulation, share a conference board, or share patient education material via a link.
• Legal and safety: where required by law, regulation, or a valid legal request, or to protect the rights, safety, and property of Medad, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

Some of our service providers may process data outside the Kingdom of Saudi Arabia. Where this happens, we take steps required by applicable law to ensure an adequate level of protection.

Payments are processed by PayTabs on a secure hosted payment page. Your full card number and security code are entered directly with PayTabs and are not stored by Medad. We receive and keep limited transaction details, such as the transaction reference, amount, currency, plan, status, and date, to manage your subscription and payment history. PayTabs processes your payment information under its own privacy policy.

We keep your information for as long as your account is active or as needed to provide the Services. You can delete individual items such as history, templates, and library resources within the app. When you request deletion of your account, we delete or anonymize your personal data within a reasonable period, except where we must keep certain records (for example, payment and tax records) to meet legal, accounting, or dispute-resolution obligations.

We use administrative, technical, and organizational measures designed to protect your information, including encryption in transit (HTTPS), authenticated access controls, and restricted access to production systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your login credentials confidential and notify us promptly of any unauthorized use of your account.

Subject to applicable law, including the PDPL, you have the right to:

• Be informed about how your personal data is collected and used;
• Access and obtain a copy of your personal data;
• Request correction of inaccurate or incomplete data;
• Request deletion of your personal data when it is no longer needed;
• Withdraw your consent at any time, without affecting processing that took place before withdrawal; and
• Opt out of marketing communications from your privacy settings or by contacting us.

To exercise these rights, email us at info@medadhealth.com. We will respond within the period required by law, and may need to verify your identity before acting on your request. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).

We use cookies, browser local storage, and similar technologies that are necessary to keep you signed in, remember your preferences (such as theme), complete payments, and keep the Services secure. We may also use analytics to understand how features are used so we can improve them. You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the Services from working.

The Services are intended for healthcare professionals, students in healthcare fields, and organizations aged 18 or older. We do not knowingly collect personal data from children as users of the Services.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and notify you through the Services or by email. Your continued use of the Services after the changes take effect means you accept the updated policy.

If you have questions about this Privacy Policy or how we handle your data, contact us:

• Email: info@medadhealth.com
• Phone: +966 54 753 6631
• Location: Kingdom of Saudi Arabia